983ebcd6770197fbd70daf69928311b995026f3c5bb6c6446f25d201e3dfad58

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 18:56

Target

9313.exe
Size

2.2MB
MD5

f04a041b1e1475c62746610041aea1cb
SHA1

449c858446dcc29fca49ce5c59fd80618c8a61f2
SHA256

ff0c4377a167b7c66c0b26315e784493cf2279cab5f00c751115b9cc840d4a28
SHA512

634ca32963aa0920399476f7a90fa10265e242629349a42f1681a304dd61e495c234263cc46cb08bc327a00d405501eaa4a72147677ee3aff81578cc951b1e89
SSDEEP

24576:4elo5jh+9b8SL1lAdL5+FPI3YqOcHQSFablTmVfzxquGjHneFUJfKOO:ll+h+1qs0Y/BTmOuGjHnev5

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1280	9313.exe

C:\Users\Admin\AppData\Local\Temp\9313.exe
"C:\Users\Admin\AppData\Local\Temp\9313.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1280

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1280-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1280-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/1280-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download