139d8d6c6bef2cf9c56015d95a26137746fd641cf60ee553a34af27c6e514936

Analysis

max time kernel
140s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 04:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

965.exe
Size

2.3MB
MD5

08a65cf5038ac1281847292c8752f869
SHA1

4971038749d135a8710fd0850ba533b449b7d4a6
SHA256

3f09d42fa07dba9d84c1c86b3092faabefcff1d5f2d3a8c61b2cc8128427c90f
SHA512

72b62ddfae3bee957226a4f3770b2f7624599bc37a44bd1ee6f1322e231883f2033cbf86a362df45ab78e8ff56379cf61a3965d277d2e2c18f7b947bbf96d47b
SSDEEP

24576:jelo5jh+9b8SL1lAdL5+FPI3YqOcHQSFablTmVfqxquGjHneFUJfKA+6kdPz:Kl+h+1qs0Y/BTm1uGjHnevAePz

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1476	965.exe

C:\Users\Admin\AppData\Local\Temp\965.exe
"C:\Users\Admin\AppData\Local\Temp\965.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1476-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1476-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/1476-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1476-4-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download