6ac2b43431285c5ea88c5c48770b33b5327a9daa890c999354c340d7807052f2

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 17:03

Target

$PLUGINSDIR/quickzip.exe
Size

3.1MB
MD5

47a4632388eef08cf134ef192005df97
SHA1

32cf50ca6d56b75175bb84eca80dcf05ce187cce
SHA256

0670d04c019b2b25b0550d1913dc366ce68a1e52a6e275cb0c9b21ab456dc7b8
SHA512

3b4050937e98fe70a5474fdd2c349fd099f82aacf73c76b050659ab7670b4893bd096caeda3dcaa3966c9f31c7bb35fc98a9ea8e30efe5c03e25a51245a657b2
SSDEEP

98304:Gq9dLs1qZysB3PR3HJj+Ca2ZZrzcL91LQnTzqhCd:Z9Zs4dB/R3pj+CjZVUv0nTPd

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2908	quickzip.exe

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\quickzip.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\quickzip.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2908

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact