2b3284230452e9d38c6d1832c98f3b37198f858d1d3cfcb4ead4996f5016b4eb | Triage

Analysis

max time kernel
88s
max time network
85s
platform
windows7_x64
resource
win7-20220414-en
submitted
15-06-2022 03:02

Sharing

Report Analysis Logs

General

Target

2b3284230452e9d38c6d1832c98f3b37198f858d1d3cfcb4ead4996f5016b4eb.exe
Size

149KB
MD5

03b8d1c184feeee8b8bf97e808251b5c
SHA1

68689df1b8ace15e8f8c90603f2f060c1d593b18
SHA256

2b3284230452e9d38c6d1832c98f3b37198f858d1d3cfcb4ead4996f5016b4eb
SHA512

26fcf7a05fcb0d5c562f5ef9af55b02c05e5482b77ffe597ec989803c0ebc3e4804322c9c760a2ffe89342a71da6596942b2bd4de0e8fd434fb9df15c075f034

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

2b3284230452e9d38c6d1832c98f3b37198f858d1d3cfcb4ead4996f5016b4eb.exe

pid process

1052 2b3284230452e9d38c6d1832c98f3b37198f858d1d3cfcb4ead4996f5016b4eb.exe

C:\Users\Admin\AppData\Local\Temp\2b3284230452e9d38c6d1832c98f3b37198f858d1d3cfcb4ead4996f5016b4eb.exe
"C:\Users\Admin\AppData\Local\Temp\2b3284230452e9d38c6d1832c98f3b37198f858d1d3cfcb4ead4996f5016b4eb.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1052

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1052-54-0x00000000750C1000-0x00000000750C3000-memory.dmp

Filesize
8KB

Download
memory/1052-55-0x0000000001000000-0x000000000102F000-memory.dmp

Filesize
188KB

Download
memory/1052-61-0x0000000001000000-0x000000000102F000-memory.dmp

Filesize
188KB

Download
memory/1052-62-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download