2014d50d8151c6d5c144caf00be4241f201d4c16e59a057046aa9ef09361500d

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 14:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2788c4f5007715a008c023ce3659464a.exe
Size

218KB
MD5

2788c4f5007715a008c023ce3659464a
SHA1

3503a1d5e7f94e4db8583077edc7b1c0a23e54e3
SHA256

2014d50d8151c6d5c144caf00be4241f201d4c16e59a057046aa9ef09361500d
SHA512

5a79c666761cd698de27e778e4074642aea26cb25e699fdf6728e45a3faea862d46d8ad1978f6879b71d45845fa21f5803807f97a4c2ff731667ad4b183b1a42
SSDEEP

6144:wwaSgEx8DF/WQe99A0N6o2/ZBTcCsggMFY9w:w3pNp0N6b/rcCRFY9w

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\SmartArrange.job	2788c4f5007715a008c023ce3659464a.exe

C:\Users\Admin\AppData\Local\Temp\2788c4f5007715a008c023ce3659464a.exe
"C:\Users\Admin\AppData\Local\Temp\2788c4f5007715a008c023ce3659464a.exe"
1⤵
- Drops file in Windows directory
PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3048-5-0x00000000002B0000-0x00000000002DF000-memory.dmp

Filesize
188KB

Download
memory/3048-9-0x00000000000A0000-0x00000000000C0000-memory.dmp

Filesize
128KB

Download
memory/3048-4-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/3048-3-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/3048-17-0x00000000000A0000-0x00000000000C0000-memory.dmp

Filesize
128KB

Download
memory/3048-2-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/3048-1-0x00000000000A0000-0x00000000000C0000-memory.dmp

Filesize
128KB

Download
memory/3048-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download