8c0e3733b8c82b012b3198e12ea2fd1c82a2ec4859e951b3b8c11981d14b1992

Analysis

max time kernel
140s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 10:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

341.exe
Size

2.4MB
MD5

6b8e41e4e62ef6daabf62be3494f9f0f
SHA1

ff750659f96def5c134ba4fe2ce4d4539d19cb80
SHA256

3014b9d8d2ae6dbd733743854d2fa3119f9520b35e1959cd59e5b25b2242782d
SHA512

9737e30feba397ff7d17ef6e65188df0a09acef8f06b6b9890275f7b68f54c2f9ad8f172f0968826a50f59d2207a2a3bffb7b874a4ebfdf530f80d93fc078ed6
SSDEEP

24576:felo5jh+9b8SL1lAdL5+FPI3YqOcHQSFablTmVfYxquGjHneFUJfKnCTMZrCto7k:Wl+h+1qs0Y/BTmnuGjHnevnBwo7VO

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1768	341.exe

C:\Users\Admin\AppData\Local\Temp\341.exe
"C:\Users\Admin\AppData\Local\Temp\341.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1768-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1768-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/1768-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1768-5-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download