ec3bdb1428cb549257a5b7c61f83fa94071fc0fdfd13cd2a923005d46fb773df

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 12:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

868.exe
Size

3.0MB
MD5

dd46994065a29652c678b3b089b7d662
SHA1

6a1d7dad5125c06f15d6b5c6783a18afbef4667c
SHA256

39cd204a71475a4519ee35865dd04a583df8d9d062fb376112638048068ad4af
SHA512

4758aaa0649f27519beec4c7fdfa72f60a55a2958b201a26b4619efae6efe48c69fd2e41bd5dd3ee5b9099926460f5afc70baf5b3470207d04b8939ef1aa3a20
SSDEEP

49152:Pl+h+1qs0Y/BTmauGjHnevm4ZQtHR3UwUgcg:PlK+19V/rjHnevoHoG

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1736	868.exe

C:\Users\Admin\AppData\Local\Temp\868.exe
"C:\Users\Admin\AppData\Local\Temp\868.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1736-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1736-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/1736-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download