7c3b06d9011313856917d73b139b7f2d5350c27fa36d2ee12c898241e9d60aa0

Analysis

max time kernel
140s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 20:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5484.exe
Size

2.3MB
MD5

bc990075c079e91a7869bc0b61f64744
SHA1

bcd9022850c82d259324fbbfcd9bd54ab12aa9ed
SHA256

3b1f2202c41c4f24aeb73a723d20751a1a46274d53aa118b3d45c010ed7ebe9b
SHA512

b7d745d22f1c0e540dec62f665b629292440291c25920896fdd88bb5610aa1d9c0b3644b2d118e73ddb11f8bbc62b840b4a8e3087f45666ad9eace0037abb90d
SSDEEP

24576:nelo5jh+9b8SL1lAdL5+FPI3YqOcHQSFablTmVfaxquGjHneFUJfKSm5wpDflp:el+h+1qs0Y/BTmNuGjHnevSQcD3

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2208	5484.exe

C:\Users\Admin\AppData\Local\Temp\5484.exe
"C:\Users\Admin\AppData\Local\Temp\5484.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2208-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2208-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/2208-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download