3baa591a03fd01123c0bcf1741bc392f1d65ea8e7af02567fc3153b25204ea64

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 04:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4710.exe
Size

2.6MB
MD5

aae86c1a0adb8d0e675f7a2f20ba59b1
SHA1

7d1469634b6ac2ca160786a48dbd1e05927170f1
SHA256

aad93b718eccbc6dcbab4aa59b4ad42d62529936144e5a93f9626ef6755fc4f2
SHA512

7535530ec51581cc488df8c2568932e0d127fe2331f95fedfffbdf932713bff7582954ab493c9948680e6b01a0c785b0e31d59f16915b602c04a1d214cd1f165
SSDEEP

24576:Selo5jh+9b8SL1lAdL5+FPI3YqOcHQSFablTmVfaxquGjHneFUJfKje/4Ao1G/aN:Ll+h+1qs0Y/BTmVuGjHnevjQ58J7Au

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2424	4710.exe

C:\Users\Admin\AppData\Local\Temp\4710.exe
"C:\Users\Admin\AppData\Local\Temp\4710.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2424-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2424-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/2424-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download