c9bfdf2eb113cd7d4a8287dd176df5a175b2079cd36041d790810ec77d5aabae

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 03:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8986.exe
Size

2.4MB
MD5

f417b80edc918ce851f3f1f53fb0a152
SHA1

4edecb6999f1fd3238317b13bbbc2b7f6ac173ff
SHA256

bf39899a223d4ac348c7be0aa021ae2e40fcef4781827b847fefe19b18552e95
SHA512

1bbae2b8a7cbc3314944e61fadd9c0bf8e82618b3e269d7037bd6e42a3858030a2382eec0faa19cf07552b9c84db07400dfa523d00e9e907c6df16bbc6718591
SSDEEP

24576:Selo5jh+9b8SL1lAdL5+FPI3YqOcHQSFablTmVfixquGjHneFUJfKp+J9eKN3lbo:Ll+h+1qs0Y/BTm9uGjHnevpi9eKNlbo

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1900	8986.exe

C:\Users\Admin\AppData\Local\Temp\8986.exe
"C:\Users\Admin\AppData\Local\Temp\8986.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1900-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1900-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/1900-2-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/1900-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download