0db06a7bcbec2c9e177697af84a62156f34d6960b46315d4ae6df29fd72986f7

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 16:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9932.exe
Size

2.6MB
MD5

fa21af88000b2e9cdb96b27fb1b01194
SHA1

bf2f9437890f9a0d6b2359c2cac2e8944292a514
SHA256

b80757858e29e458343b6237298c8bf4a14bc71c33ba33ee7fa65e0189883537
SHA512

64c78366f116bfaae26f7d90b5f3b5d28ff3c59457ddc290a0d7bf8ec51867528650ef9394fad97c2a34429f5ecccd4297fc7d2671e57d1a303cd0c0836f444f
SSDEEP

24576:zelo5jh+9b8SL1lAdL5+FPI3YqOcHQSFablTmVfaxquGjHneFUJfKi9xb7CV1IQ0:al+h+1qs0Y/BTmluGjHnevvul7Rz

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2764	9932.exe

C:\Users\Admin\AppData\Local\Temp\9932.exe
"C:\Users\Admin\AppData\Local\Temp\9932.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2764-0-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2764-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/2764-3-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download