429357fc4f3f559d5d0aaff88109356ca516daca3397faf0c88573e66a5c27d5

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 09:33

Target

cdrswc.asp
Size

72KB
MD5

3acf21a4ea043ce4d08357ed3025d014
SHA1

343c6685d0370cb261e33ab5959325c881c8de15
SHA256

429357fc4f3f559d5d0aaff88109356ca516daca3397faf0c88573e66a5c27d5
SHA512

f05387f7e1af30719d046670d3c3afea37193786b76940bc35c761b6972731d2b1f7dbeb1a5bbed6483a75c1524615c2cf874210158a4cb3f3d525e9e866ba06
SSDEEP

768:XOGWHDIgZc6H4UUhIgBYU5Gkgv/eeAKm5DiQXxbFB1pLWCdbSOz:+H4MgBngv/U5PZNWrOz

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2328	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\cdrswc.asp
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2328

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2328-25-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download