ed293a2c896844a82f1e839899017dfac4beb12824adb7cb8d4a805d61e6e0f5

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 16:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ed293a2c896844a82f1e839899017dfac4beb12824adb7cb8d4a805d61e6e0f5.exe
Size

625KB
MD5

8f5cf745410f952789a5062b81879885
SHA1

6047cd8ba9e8c7b9e6ecd4240495566788f16752
SHA256

ed293a2c896844a82f1e839899017dfac4beb12824adb7cb8d4a805d61e6e0f5
SHA512

03ba0690d55fc94e9cea20d66e19928e64f04210fafb3db398dc73cdaa090852eee5bb25753e0b6e6e0ab86d71dd3a5b2b7bd0cc40668e9c63db39f42df3a8f5
SSDEEP

12288:laWzgMg7v3qnCiMErQohh0F4CCJ8lnyPQz:UaHMv6CorjqnyPQz

Score

5^/10

Malware Config

Signatures

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2564-0-0x0000000000400000-0x00000000004B3000-memory.dmp	autoit_exe
behavioral1/memory/2564-1-0x0000000000400000-0x00000000004B3000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\ed293a2c896844a82f1e839899017dfac4beb12824adb7cb8d4a805d61e6e0f5.exe
"C:\Users\Admin\AppData\Local\Temp\ed293a2c896844a82f1e839899017dfac4beb12824adb7cb8d4a805d61e6e0f5.exe"
1⤵
PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2564-0-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2564-1-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download