0c065764b9151d1737e9747446b4d58b9cdd70ee80ba189dcc61c4710e32d63a

Analysis

max time kernel
140s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 00:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3095.exe
Size

2.6MB
MD5

c66077cd154bda07178d8c104e48fc07
SHA1

0a3f78f39e05d9b3145f1d94d32d4fa3d2930a6c
SHA256

c8b2ff1cbdbdfc35b784e25e9ec57c7c822d8120b3a4e63d96d53a46b707a08d
SHA512

6a36c5ebd23b7c1d8b6b3452b33c141c83a73d5765f8be98314a9e16af09d344fafb7f923decb8644248137092dcaf51aac7580b20937cdd15a46ea0d313b990
SSDEEP

24576:0elo5jh+9b8SL1lAdL5+FPI3YqOcHQSFablTmVfqxquGjHneFUJfKjGA71Uw0gAc:hl+h+1qs0Y/BTmVuGjHnevjXUhgJBrN

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2320	3095.exe

C:\Users\Admin\AppData\Local\Temp\3095.exe
"C:\Users\Admin\AppData\Local\Temp\3095.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2320-0-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2320-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/2320-3-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download