1502da95475e20fe2dcfd556ed193aa12d3d8180e49088f30672bb754edc5759

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 10:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66d26441574921c7563c4393f49261df.exe
Size

316KB
MD5

66d26441574921c7563c4393f49261df
SHA1

18b6390c8276653657edded81d9287fd2c39f263
SHA256

1502da95475e20fe2dcfd556ed193aa12d3d8180e49088f30672bb754edc5759
SHA512

cab3c4a78a92b4a5351993a4a767262bcfa1c246152eeb13c294ce0e087781a070ad233d64f8a57d3a4127383ec31d0abda3f1c468ea40f8b83e1a172f1f29a5
SSDEEP

6144:qdj7xw2KP9uNWKEaUx9wa3+u4nKq+PIT7kFUow7w:8K2bsPzIKPvUow7w

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\WalkKeeper.job	66d26441574921c7563c4393f49261df.exe

C:\Users\Admin\AppData\Local\Temp\66d26441574921c7563c4393f49261df.exe
"C:\Users\Admin\AppData\Local\Temp\66d26441574921c7563c4393f49261df.exe"
1⤵
- Drops file in Windows directory
PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2224-3-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2224-4-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2224-2-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/2224-9-0x0000000000110000-0x0000000000130000-memory.dmp

Filesize
128KB

Download
memory/2224-5-0x00000000005F0000-0x000000000061F000-memory.dmp

Filesize
188KB

Download
memory/2224-1-0x0000000000110000-0x0000000000130000-memory.dmp

Filesize
128KB

Download
memory/2224-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2224-17-0x0000000000110000-0x0000000000130000-memory.dmp

Filesize
128KB

Download