8f99d292a7fe5fa5f5d3938181d3f0d0311e27b0b2c7f713ec1042595d235e66

Analysis

max time kernel
140s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20-07-2024 22:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1562.exe
Size

2.6MB
MD5

3a16468de9d73dbc696ab6f84c951d8c
SHA1

a879b6e13d6782291569f956f2b2f6f46f01742f
SHA256

46ee5becb4e38f033509eb309bf6df5b59d778e1a1c233932ae9f0e4964e84a2
SHA512

bf37256daac0decf1e9e23335275d7d325b488ae9bf0ba23d7a507f10d97f4f9ca9cbea8b3e66719f30f66558b70a2890dbe7b75dc663abed2d1b283094e3a34
SSDEEP

49152:nl+h+1qs0Y/BTm+uGjHnev4q9TfFcIuvbEeiiK:nlK+19VbrjHne1TGBYqK

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1768	1562.exe

C:\Users\Admin\AppData\Local\Temp\1562.exe
"C:\Users\Admin\AppData\Local\Temp\1562.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1768-0-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1768-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/1768-3-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download