20aaf7561ecb5ed79a41dacd5b5357ea9766d2c843610cd21ded4b7489206110

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 10:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4354.exe
Size

2.3MB
MD5

af4bc8144ed3151b779caf32b3e42089
SHA1

1a07903fd8e2c51c2cf515f0118ba6ff8575efeb
SHA256

5c94afd0669ab6afa9307080d695edb26c53a5c7773cfec4a2c2f086b77ba23c
SHA512

3734799bfd91fe773d8ede199e6f53ba25c8d1e112af52c74c85bdff5a30279cca8c939cebc53c7a69f25090a02e1afc26eeb8f65b61b9c394e8cb5310081b8c
SSDEEP

24576:Lelo5jh+9b8SL1lAdL5+FPI3YqOcHQSFablTmVf6xquGjHneFUJfKxm1fb:yl+h+1qs0Y/BTm9uGjHnevxafb

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2892	4354.exe

C:\Users\Admin\AppData\Local\Temp\4354.exe
"C:\Users\Admin\AppData\Local\Temp\4354.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2892-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2892-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/2892-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download