169605839aebe681cc8f32304083932a0a710dad4d24c900a9dc17d92f6efd29 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 01:15

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/FiddlerSetup.exe
Size

3.1MB
MD5

7e3090e237b9f252efc88d097f71ed47
SHA1

8a1cae86f421c4c74f7f543609826cfc472e5fa8
SHA256

91547aa10f5b4d1be95c7bfa289499ded2b65d1070ec6fce0208e61771df5318
SHA512

378d29ca00b73ff5b729d6bc39e63b61f833f7baad9d806db77ee7acab993b3b567f7e533aae2178bf8a9391bc8d205aadd72d75a29a71c0f2827196ff040afa
SSDEEP

98304:QIouszMd5OYRxqFu5rMnb8ELGUHjvYEarht:rqzMSx3oo8

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

FiddlerSetup.exe

pid process

2224 FiddlerSetup.exe

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FiddlerSetup.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FiddlerSetup.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2224

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...