043e49a01eabee90367fda36730229e8a317456439397ddd253d357a180f1407

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 07:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7057.exe
Size

2.3MB
MD5

2c6edb44a97c98949f546d1a7f510440
SHA1

663acf095cbbcaa26972e5af03fea088acf6cf68
SHA256

522d1625e5fb90926cbf5c6a94432c62374dddca554dbb29d6cac7b9371be3a2
SHA512

bab92a6278a74a5ef973cbbd7999006c74f57dffe8f46a766bd97f61e5f7b9dd6edebd91f1556023573ca5df393006d91f4b40a640e6496be8722eb654fbede2
SSDEEP

24576:selo5jh+9b8SL1lAdL5+FPI3YqOcHQSFablTmVfoxquGjHneFUJfKWeOG6X:Zl+h+1qs0Y/BTmfuGjHnevWdF

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2484	7057.exe

C:\Users\Admin\AppData\Local\Temp\7057.exe
"C:\Users\Admin\AppData\Local\Temp\7057.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2484-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2484-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/2484-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2484-5-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download