5d3997c7f234df5fff4d3c8ca34628ea86b1661e52367df40ef97dc8b9fb7407

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 07:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11e1f351761be053235e0c81838d30c3.exe
Size

298KB
MD5

11e1f351761be053235e0c81838d30c3
SHA1

07e9e0345dcb5220f8997246c4b07ca737353bcd
SHA256

5d3997c7f234df5fff4d3c8ca34628ea86b1661e52367df40ef97dc8b9fb7407
SHA512

fac6ba718581ed735251f6c02580a0993318f09f8a89f2df1a5a7ffcbd6562a394d8a8ae5225936f7f12973b1417efafb973af99843c6559a4e8117f719a1759
SSDEEP

6144:6qvh9fzMfF1/uISHy+m7CswhewVbsOLaWLaQ:6qTuF1/ufHy+m7ZwowmgaWLaQ

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\EasyTranslate.job	11e1f351761be053235e0c81838d30c3.exe

C:\Users\Admin\AppData\Local\Temp\11e1f351761be053235e0c81838d30c3.exe
"C:\Users\Admin\AppData\Local\Temp\11e1f351761be053235e0c81838d30c3.exe"
1⤵
- Drops file in Windows directory
PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2420-0-0x00000000007E0000-0x0000000000820000-memory.dmp

Filesize
256KB

Download
memory/2420-3-0x0000000000D20000-0x0000000000D60000-memory.dmp

Filesize
256KB

Download
memory/2420-1-0x0000000000A20000-0x0000000000A60000-memory.dmp

Filesize
256KB

Download
memory/2420-4-0x00000000000F0000-0x000000000011F000-memory.dmp

Filesize
188KB

Download