4ec3021f612bb65a615205e4c12f8f14db4d78196960187e7314169791ffe488

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 08:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13dad47a9e77487c3b57d64a8b298af7.exe
Size

297KB
MD5

13dad47a9e77487c3b57d64a8b298af7
SHA1

ba01b48ec1942ab8ef5a114557c98c6c20045882
SHA256

4ec3021f612bb65a615205e4c12f8f14db4d78196960187e7314169791ffe488
SHA512

dcc32abb92bd5acf91c12b03bc16175166d9d8ae3a172d19d6f4efeb08da8ae1a68e2bc14f117ecc47ed4ac89a016fd5e8d3e9c57542b238b0f2f538d854a023
SSDEEP

3072:V7zphty0Bs5SZQlTIUOeDHNuddjslBa7G5+XJHvd4SbHLqDosTGaWsm:ThSSZUv2dj0ByP5HLqDo1aW/

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\MedReminder.job	13dad47a9e77487c3b57d64a8b298af7.exe

C:\Users\Admin\AppData\Local\Temp\13dad47a9e77487c3b57d64a8b298af7.exe
"C:\Users\Admin\AppData\Local\Temp\13dad47a9e77487c3b57d64a8b298af7.exe"
1⤵
- Drops file in Windows directory
PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2368-0-0x0000000000A30000-0x0000000000A70000-memory.dmp

Filesize
256KB

Download
memory/2368-4-0x0000000000200000-0x000000000022F000-memory.dmp

Filesize
188KB

Download
memory/2368-3-0x0000000000100000-0x0000000000140000-memory.dmp

Filesize
256KB

Download
memory/2368-1-0x0000000000970000-0x00000000009B0000-memory.dmp

Filesize
256KB

Download