640f6fa7a32a694b0912bd9042ac043f7e1252cb28db7385a3c2060d327d32b7

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 02:37

Target

.exe/ExecutedProgramsList.exe
Size

81KB
MD5

7366668cc7eaa1068a38cc2761217fc4
SHA1

a6790473129e7298185ef4ee4e0badbdecc50040
SHA256

e3af98717bf1cda7dc4aacb5b34d111ac237604161cd96f7929ec33f2ff260b6
SHA512

5af36447a1d29c2024b83cf08bb9cfc2c360e02d819eb7b238e1e9f774aef6e5930f5f33b9f64d62e4e958911493338a0d95b58b22b076c4e9025abe6f3f0b4a
SSDEEP

1536:mnfPc3+xpqH7tTkloB7MYk34T8bbcw+BI2SNGOcJ74l8:mnf03+xpq71kl0QYk3Jbww+JSNGOcZ4q

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2124	ExecutedProgramsList.exe

C:\Users\Admin\AppData\Local\Temp\.exe\ExecutedProgramsList.exe
"C:\Users\Admin\AppData\Local\Temp\.exe\ExecutedProgramsList.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2124

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact