15d518b086134cb1bfc77644857fb679e320d419f46a67df3d3e25761781c192

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1b19cbccd572d928acb725e01e0b1ce6.exe
Size

236KB
MD5

1b19cbccd572d928acb725e01e0b1ce6
SHA1

6159270322a92fb30ff9cb06be4a73274d5f8803
SHA256

15d518b086134cb1bfc77644857fb679e320d419f46a67df3d3e25761781c192
SHA512

7a280475e9ac2bc3782b47c84d520dafbb0db3a8c8e83db54d110278d0683210083cf58735934da76ade8cd409fc95b41f53b916452bcbc6bbbe983b2f473c14
SSDEEP

6144:qzTLz5PYIAgh1oD2FhyWSSBKlAzApUZD3:05QK1sWSSQlAlZD3

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\EasyBooks.job	1b19cbccd572d928acb725e01e0b1ce6.exe

C:\Users\Admin\AppData\Local\Temp\1b19cbccd572d928acb725e01e0b1ce6.exe
"C:\Users\Admin\AppData\Local\Temp\1b19cbccd572d928acb725e01e0b1ce6.exe"
1⤵
- Drops file in Windows directory
PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1748-2-0x0000000000E00000-0x0000000000E40000-memory.dmp

Filesize
256KB

Download
memory/1748-0-0x0000000000BF0000-0x0000000000C30000-memory.dmp

Filesize
256KB

Download
memory/1748-3-0x00000000000F0000-0x000000000011F000-memory.dmp

Filesize
188KB

Download