0ca91bb6f4a7ddc5981e8b9832f86522682247ecb5d5b7fa09c9873489f472c4

Analysis

max time kernel
140s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 07:07

Target

9600.exe
Size

2.2MB
MD5

2dac1945944cb2d4bdf975a70e311558
SHA1

76f253988d6e8f256437e1613d379a5e0a7831d3
SHA256

07834787580be3aa0097671819fad9996ec0a3c786f4d25be717103c214b8ab3
SHA512

bbd0c600f3d3352b9de29c4da62278175a7ad003f8a9416a3c6dba23a1a322457d8ea573f16b95b53de71b9b1565031efa90963e28a72f173c51aaa67ae7436c
SSDEEP

24576:3elo5jh+9b8SL1lAdL5+FPI3YqOcHQSFablTmVfUxquGjHneFUJfKv5:ul+h+1qs0Y/BTm7uGjHnevx

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2908	9600.exe

C:\Users\Admin\AppData\Local\Temp\9600.exe
"C:\Users\Admin\AppData\Local\Temp\9600.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2908

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2908-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2908-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/2908-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2908-5-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download