ad1d8e5319eba6d1a68ace2fe36b217a0e420ec9007c7f340021d1cd3d5c31ed

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 01:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

352.exe
Size

2.5MB
MD5

c6c2777ea34a527a0d6ec0b122036aaf
SHA1

f6bff28e03f67720eb98180db009eedec4af676d
SHA256

30a10ca41bc27289700c9132a99fefeffc6d7e8bc2f42b64ff95195a849098d4
SHA512

01804f5ba8bd893b5e01ddab2b59dc17fcfb1dab18ef71c852020522e812177fd3adceb5fdf92ca15bc34d4d784b2f322d433514a7d6db515c6bbb4492d778fb
SSDEEP

49152:al+h+1qs0Y/BTmruGjHnevENr+cGsc0a8+:alK+19VOrjHneYr+Aa8+

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2076	352.exe

C:\Users\Admin\AppData\Local\Temp\352.exe
"C:\Users\Admin\AppData\Local\Temp\352.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2076-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2076-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/2076-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download