3583356b1900cc2f31f3a9115c912814069c1a8b233e48a274351d0ea3ec3a5e

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 13:05

Target

Doc/Database/Dict/SpRuNorm.lex
Size

2.0MB
MD5

07e9b0a041a27522c114dc746a6042bc
SHA1

0b25980ce4c3c87209c36b62ce31f63a58226a2b
SHA256

07b6d00942e615a3618bcb8f9b8a2f0a105605b9916fb72a596dc346b68f77a0
SHA512

397ec614a31b612a33682326d8831efd83af1b06c2d3c1532811c6388a8dbe2f5814add00db8eb347d431a202eb6f4b85b6a6ecc65bba80bf7b6b1d20a814681
SSDEEP

49152:NPcvX0Vwn3TBBxnjtXRfox2/s3WxUI3KezAbPOv/5Sd6X:An9Bpfl/9UKvX

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2872	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Doc\Database\Dict\SpRuNorm.lex
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2872

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2872-21-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/2872-26-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download