1cc4716597f90205fffb6c96e40b7d298a9647247059ec12d54ba36e5ac97837

Analysis

max time kernel
140s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 09:07

Target

oooplayer_bet13_setup64bit/TFileInfo.exe
Size

5.9MB
MD5

890aa797428da573be2932b1755132e6
SHA1

f0a40e602cd1cb5d52863ce67f4951859b4fd9da
SHA256

660a20dddb41f88380edf95de958f04f0684e816997be728c72e20dab6338f63
SHA512

08d3c3a10211361b538e71a59fae395b3c18a58c3813253951b3d4b8dc8672cb9d2a2d809ee7acb935913ba8a73ae27033688d6893602f52c5683ff3d9b7c97a
SSDEEP

49152:zgEQAoYQAgTf31GKqlLmG8Yzj2Iceixi5LWMCoGefaSuLBE/MPpplDhoeo514RM:mfFG9z/ioeogRMkes

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
704	TFileInfo.exe
704	TFileInfo.exe

C:\Users\Admin\AppData\Local\Temp\oooplayer_bet13_setup64bit\TFileInfo.exe
"C:\Users\Admin\AppData\Local\Temp\oooplayer_bet13_setup64bit\TFileInfo.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:704

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/704-0-0x00000000027F0000-0x00000000027F1000-memory.dmp

Filesize
4KB

Download
memory/704-6-0x00000000027F0000-0x00000000027F1000-memory.dmp

Filesize
4KB

Download
memory/704-5-0x0000000000400000-0x0000000000A87000-memory.dmp

Filesize
6.5MB

Download