128f9bcaeeb3e0612e5250600612e187881c137855c2c3f7c87d0dde1f915e0e

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8757.exe
Size

2.5MB
MD5

9d3f262609cd702157cfb479056e003a
SHA1

de13d80e523b1f132d6ae8dd6f88318d62c2c96a
SHA256

6c4733b6bbe82cbe4636e4204d5a8f4e48d1e4f9a328144b5351f875ece62ae7
SHA512

4fb109dd15619bca438efd2b658cd6ec7bddc6e47ea5c975872fecde1d0719183afd8735da9aa24ba30d4b0207228248e0599ce6e9d1d8dc5f34e69083e7f20b
SSDEEP

24576:Delo5jh+9b8SL1lAdL5+FPI3YqOcHQSFablTmVfOxquGjHneFUJfKCjQgwItB9Qw:ql+h+1qs0Y/BTmhuGjHnevCkVIB9Q7M

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1044	8757.exe

C:\Users\Admin\AppData\Local\Temp\8757.exe
"C:\Users\Admin\AppData\Local\Temp\8757.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1044-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1044-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/1044-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download