fff8c30d879767858353416fde0fe0a2dfc45ef651e860956942496549add9b7

Analysis

max time kernel
11s
max time network
15s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 05:26

Target

fff8c30d879767858353416fde0fe0a2dfc45ef651e860956942496549add9b7.exe
Size

4.9MB
MD5

3a2ebe4fb57d94ea3d4327790eb43815
SHA1

024f0be3c1bc1de0335a52d85210a84b9769bb10
SHA256

fff8c30d879767858353416fde0fe0a2dfc45ef651e860956942496549add9b7
SHA512

4a7ed6c599aedd81a9f7e711e14a1e70e18a50051bf52f2bbd48f50151037c8abf10c572d678bf40766bc15985b203dc0382d49e0fc7e7acd62dd10e87cd5f6d
SSDEEP

98304:38RkWHh546nNb4ggPb+NVHAsM+6rTXg5s+IqoOV80coNEyvpID:sRkS546nBHJA66rruIROG51Mp

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3012	fff8c30d879767858353416fde0fe0a2dfc45ef651e860956942496549add9b7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3012	fff8c30d879767858353416fde0fe0a2dfc45ef651e860956942496549add9b7.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/3012-0-0x000000013FA50000-0x0000000140D6F000-memory.dmp

Filesize
19.1MB

Download
memory/3012-1-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Filesize
3.8MB

Download
memory/3012-3-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Filesize
3.8MB

Download
memory/3012-2-0x000000013FA50000-0x0000000140D6F000-memory.dmp

Filesize
19.1MB

Download