Analysis

  • max time kernel
    151s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/10/2022, 15:03

General

  • Target

    abf896681b33b8980dde7868028ac5c3c533f1da681f2773d1e2f24974bc0eac.exe

  • Size

    104KB

  • MD5

    707cdc84ef85698e3c6a1a7a55b315d9

  • SHA1

    5f53d19491c00f52af7f9a23609f3278992b9922

  • SHA256

    abf896681b33b8980dde7868028ac5c3c533f1da681f2773d1e2f24974bc0eac

  • SHA512

    cbe2135abb98ee518f62f9aebaaf38f23708517ce046dcf67059f51540203354b44899040c96f80fe7d3271edea43a6e6a097cea2028171fc54335ef406711f1

  • SSDEEP

    1536:0iJCY12G0sUsHWvkAYgAvilIiT7dzzBqem:0iJCY12VsZ2UvjizzBqe

Score
6/10

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\abf896681b33b8980dde7868028ac5c3c533f1da681f2773d1e2f24974bc0eac.exe
    "C:\Users\Admin\AppData\Local\Temp\abf896681b33b8980dde7868028ac5c3c533f1da681f2773d1e2f24974bc0eac.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:5112

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/5112-132-0x00000000006B0000-0x00000000006B5000-memory.dmp

          Filesize

          20KB

        • memory/5112-133-0x0000000000400000-0x0000000000410000-memory.dmp

          Filesize

          64KB

        • memory/5112-134-0x00000000006B0000-0x00000000006B5000-memory.dmp

          Filesize

          20KB