Analysis

  • max time kernel
    122s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    26/12/2023, 13:15

General

  • Target

    717519e5625af61317ad4f02a0e3f8da.exe

  • Size

    257KB

  • MD5

    717519e5625af61317ad4f02a0e3f8da

  • SHA1

    8647ae4b54e77e18ba8a5396379cb5899fee0004

  • SHA256

    14f69fb7e895a891bfbed965ed25d130223b74fc93cfcad5d8f52211f43b626f

  • SHA512

    eeefc9724b2c058081f80789139fa5bfe9cda080305f92a49c7a0a095af2b4c4f6b900e8830318b58c73265085fc83118bbc579937bd05ba369eed5d1488d642

  • SSDEEP

    6144:8oemV35VzWLPeEXkKvqaNSAoaXAt1hf7MQziOxIc:PzVKOKvLtsTwQziOxIc

Score
6/10

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in Windows directory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\717519e5625af61317ad4f02a0e3f8da.exe
    "C:\Users\Admin\AppData\Local\Temp\717519e5625af61317ad4f02a0e3f8da.exe"
    1⤵
    • Maps connected drives based on registry
    • Drops file in Windows directory
    PID:2072

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2072-1-0x0000000000030000-0x0000000000031000-memory.dmp

          Filesize

          4KB

        • memory/2072-0-0x0000000000020000-0x0000000000021000-memory.dmp

          Filesize

          4KB

        • memory/2072-2-0x0000000000180000-0x0000000000182000-memory.dmp

          Filesize

          8KB

        • memory/2072-4-0x0000000000580000-0x00000000005A9000-memory.dmp

          Filesize

          164KB

        • memory/2072-3-0x0000000000190000-0x0000000000191000-memory.dmp

          Filesize

          4KB

        • memory/2072-5-0x0000000000630000-0x000000000065F000-memory.dmp

          Filesize

          188KB

        • memory/2072-18-0x0000000000580000-0x00000000005A9000-memory.dmp

          Filesize

          164KB

        • memory/2072-12-0x00000000005D0000-0x00000000005F7000-memory.dmp

          Filesize

          156KB

        • memory/2072-22-0x0000000000580000-0x00000000005A9000-memory.dmp

          Filesize

          164KB

        • memory/2072-9-0x0000000000580000-0x00000000005A9000-memory.dmp

          Filesize

          164KB

        • memory/2072-25-0x0000000000580000-0x00000000005A9000-memory.dmp

          Filesize

          164KB