db8fbe6ba83405abdc168dd480d0d057f287a0adc7758a99bff940a8fafa4b19 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 18:04

Sharing

Report Analysis Logs

General

Target

0a67cc85518adebbd3bd01ae9e5ab623.exe
Size

40KB
MD5

0a67cc85518adebbd3bd01ae9e5ab623
SHA1

f8a0911c9eaa29453dff5132d5425b9a3ddd27ff
SHA256

db8fbe6ba83405abdc168dd480d0d057f287a0adc7758a99bff940a8fafa4b19
SHA512

87fc687adbc554987c615aa8c8e551be91782cc2a5adc8f28339c423329ef77eaac3c5e708a864fe6e6782c9f5268bbedc27a5b28e17653e36a8b0a54ce1849b
SSDEEP

768:5kcEwCZtxEa9HZ5gXVNMGLY0It5zN+xe9aD+GGl4xaysNhEBB4XDKDBWK6S:ih3ZbbHZ5gXzMIwt5zNP44VNhEBB4+B3

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\0a67cc85518adebbd3bd01ae9e5ab623.exe
"C:\Users\Admin\AppData\Local\Temp\0a67cc85518adebbd3bd01ae9e5ab623.exe"
1⤵
PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2824-0-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download