Analysis
-
max time kernel
103s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
31/12/2023, 19:48
General
-
Target
3ae688a2bc6c723915a4892ee52b5768.exe
-
Size
327KB
-
MD5
3ae688a2bc6c723915a4892ee52b5768
-
SHA1
ee97c1d4a490a1df1031aea52573090090a22627
-
SHA256
04baad1a40f0476745ef513e54b8161d1bebf6a6a0be8a792c31556ac04ba9df
-
SHA512
d3c93314c9af7977e4901fdea8eace3d7e67d1421b4cdfb1991838204c0109349d7861ddc16cb147f40d985881681158a0c0b775b826570ee88b07104faba9d3
-
SSDEEP
6144:Jr469uEo2S1YnQmCX492DkwNP3qpYFGgjwuBGVdLAt4ZHd2i3gjd+ZD/6F2:Jr4iu6/eIo4Rsw33AtsmQz
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ae688a2bc6c723915a4892ee52b5768.exe"C:\Users\Admin\AppData\Local\Temp\3ae688a2bc6c723915a4892ee52b5768.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses