25858eaafc14cd6e2ea6c832562d1d745719ea41e4377066a1f4bd3d40ebccda

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 12:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8445.exe
Size

2.4MB
MD5

3b7b730e71540128a2124a2929250448
SHA1

848703b6b17054bcd668b24accccf327ace3ff0a
SHA256

cb1d35c04914bc8bd7ef77f696fa94310524f15f021f54a6f7ccddfa3530f709
SHA512

ee403885af4a5f7fcb8f84ee8781cd9d0cb805e3f41f5b4411fa78a442d6633ce16c87da950bcf6e96b8611fdf112a0edc2f5d61fe4bbe03d5b04cd1d37e183d
SSDEEP

24576:yelo5jh+9b8SL1lAdL5+FPI3YqOcHQSFablTmVfzxquGjHneFUJfKTS/cibdfJy:rl+h+1qs0Y/BTmWuGjHnevTLibdg

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2072	8445.exe

C:\Users\Admin\AppData\Local\Temp\8445.exe
"C:\Users\Admin\AppData\Local\Temp\8445.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2072-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2072-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/2072-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download