484f9e922af47423dd8c1feabe9b7fbe5f71297fb3ec79d7334682f0a98f2fec

Analysis

max time kernel
141s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 12:01

Target

1319.exe
Size

3.6MB
MD5

9ace0b92a59db415c4917ef2140198e8
SHA1

69be045b940170e37d4941a80e6a0028264c0881
SHA256

3650ff2d6e2e9bd9fb69f951b9e3d992e7d650b7e4edc25e30be48a281733697
SHA512

44e27ce8bc43dd00afcf4c5a8c18c472c79dbec46f68e22dd94e8b9d41a26f0608f9e53b758b4eca06cec292537f1bc996481bc9e435fab2124fd43fbe182078
SSDEEP

49152:Dl+h+1qs0Y/BTmWuGjHnevAD0rNV4KagmXOrMxUkXRj/1/WqMsABIoN6VW:DlK+19VXrjHnewPK3meA1Bb5UsAB/N6k

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2388	1319.exe

C:\Users\Admin\AppData\Local\Temp\1319.exe
"C:\Users\Admin\AppData\Local\Temp\1319.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2388

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2388-0-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2388-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/2388-3-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2388-5-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download