9135af3364c10d78af59eed82bbc2bd1ab14dc667962e9eaad6c9c05923b1a59

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 14:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3567.exe
Size

2.3MB
MD5

5cf3ad2cb1538037c7db48680a7cf959
SHA1

33ce298b505df4ebe174df8c1c7b6bdc8e34b21d
SHA256

46a930d49dd22c7c9912792380509c627dc11e00353d6c2d344d9a08ffeccb9d
SHA512

123d052afa4aac056e01372f271a94d6d5c77463b570454ec452a3ace8429b8e6ed588a2f5dabb1e5640175071034eaabb049720873e896c50ce0d420d4e00ac
SSDEEP

24576:belo5jh+9b8SL1lAdL5+FPI3YqOcHQSFablTmVfpxquGjHneFUJfKW2Tae:Cl+h+1qs0Y/BTmguGjHnevWVe

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2104	3567.exe

C:\Users\Admin\AppData\Local\Temp\3567.exe
"C:\Users\Admin\AppData\Local\Temp\3567.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2104-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2104-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/2104-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download