9c3dd40b4539a812baabc3b8e1cec9ae45a39ec8d799c1bd6e53d9d64a2366f0

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 11:55

Target

Graillon-FREE-2.8/Windows/Graillon-2-FREE-2.8.0.exe
Size

9.4MB
MD5

b15e6247e307fe3438f17aa05688ae5e
SHA1

f68fe99bf6e6ed87b8d192406f01a3669e440cd2
SHA256

b17c4d698a7ff93edbe0512bbf180c896e3ff96c6be8495d3b08dfa1d5c1cf8d
SHA512

cdfe99a47ada756f5898dc91dda695926293b4ac5207d585d30d7572b17246443a9ddeba1f9d440e6e800cef535d8b9f6a4be21301f67c6f55cb0795ddf9032c
SSDEEP

196608:1tJV+nIDBO8XnlxYmRtxtGnScMHRAErNWw+xOE1h5hOUOkqkDioCnck10:1taIDBO8XlxYmttdcMHRzOxDOUO1CXCI

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Graillon-2-FREE-2.8.0.exe

pid process

2164 Graillon-2-FREE-2.8.0.exe

pid	process
2164	Graillon-2-FREE-2.8.0.exe

C:\Users\Admin\AppData\Local\Temp\Graillon-FREE-2.8\Windows\Graillon-2-FREE-2.8.0.exe
"C:\Users\Admin\AppData\Local\Temp\Graillon-FREE-2.8\Windows\Graillon-2-FREE-2.8.0.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2164

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance