5ab7b06d5d7a043726e9b4a23419fec293cea016d2efb1f263b03fb2be3cb03a | Triage

Analysis

max time kernel
54s
max time network
50s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
02-08-2022 02:33

Sharing

Report Analysis Logs

General

Target

5ab7b06d5d7a043726e9b4a23419fec293cea016d2efb1f263b03fb2be3cb03a.exe
Size

250KB
MD5

8e22032e0b5d338ef078f5aaf302fa4c
SHA1

1052d6c2e3ad4dec24e96ee6f7ddb4abf3f7248d
SHA256

5ab7b06d5d7a043726e9b4a23419fec293cea016d2efb1f263b03fb2be3cb03a
SHA512

e219a495b2c56b7f791d3a0877f495c63e2c673444ba981c3fdf72b48c3952453d9601f7c08279dec6c47fce439a0f9400fa5dae3353826ee92f0da11bfac638

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops file in Windows directory 1 IoCs

Processes:

5ab7b06d5d7a043726e9b4a23419fec293cea016d2efb1f263b03fb2be3cb03a.exe

description ioc process

File opened for modification C:\Windows\~ 5ab7b06d5d7a043726e9b4a23419fec293cea016d2efb1f263b03fb2be3cb03a.exe

C:\Users\Admin\AppData\Local\Temp\5ab7b06d5d7a043726e9b4a23419fec293cea016d2efb1f263b03fb2be3cb03a.exe
"C:\Users\Admin\AppData\Local\Temp\5ab7b06d5d7a043726e9b4a23419fec293cea016d2efb1f263b03fb2be3cb03a.exe"
1⤵
- Drops file in Windows directory
PID:2028

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2028-54-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download
memory/2028-55-0x00000000022F0000-0x00000000023D8000-memory.dmp

Filesize
928KB

Download
memory/2028-56-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2028-58-0x00000000022F0000-0x00000000023D8000-memory.dmp

Filesize
928KB

Download