4aba60b1952361d822a3b9c26a87fbe63415b26294e472dadfa5cefe1d2fea78

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9066.exe
Size

2.4MB
MD5

1a95e02c68e6759efffac8760e446fba
SHA1

fd421412ad54729bf39104a2ebce302be6e29313
SHA256

f74a3fafae96dcdec7a051f0ae928d6be74c97280623ae33a9b23b3a18dd3bac
SHA512

0e69a3f903bee416e327c51573bcd602a5cf62c2e5a13aa15e3021c1f746cbda97fda8a24f3935c67a0b761a0fcc94f3b7b9de0e967b909793d24d462c423dc9
SSDEEP

24576:selo5jh+9b8SL1lAdL5+FPI3YqOcHQSFablTmVfIxquGjHneFUJfK7S5VGEnjhI:Zl+h+1qs0Y/BTmnuGjHnev7onjG

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2924	9066.exe

C:\Users\Admin\AppData\Local\Temp\9066.exe
"C:\Users\Admin\AppData\Local\Temp\9066.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2924-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2924-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/2924-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download