139e1c65e45bcc22777b83eac26dec50672315a2c9f05e26bb67d85b94ef66b6

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 03:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3fbb0ac976eec73dc9aec87ce1a95c88.exe
Size

314KB
MD5

3fbb0ac976eec73dc9aec87ce1a95c88
SHA1

45bfc11e7dcbb0829845b0554628666416c2384b
SHA256

139e1c65e45bcc22777b83eac26dec50672315a2c9f05e26bb67d85b94ef66b6
SHA512

e6b272e3cf8642b032ae2553e3000ef6ad25025fe4157a039ecb5dddc0eb707f0f0fca84c14636f5bd34279d76b8c905429fa4fe0f3d2392dcfc2d5d8961e07d
SSDEEP

6144:yIIVPt9RZEMTJX7DKs0MivLAi3K7aNLyK0Hu+b:bCPt9PvTJL+fJAi67aNx0O+b

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\WeatherState.job	3fbb0ac976eec73dc9aec87ce1a95c88.exe

C:\Users\Admin\AppData\Local\Temp\3fbb0ac976eec73dc9aec87ce1a95c88.exe
"C:\Users\Admin\AppData\Local\Temp\3fbb0ac976eec73dc9aec87ce1a95c88.exe"
1⤵
- Drops file in Windows directory
PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1668-4-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1668-3-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/1668-2-0x0000000000110000-0x0000000000130000-memory.dmp

Filesize
128KB

Download
memory/1668-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/1668-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1668-5-0x0000000000190000-0x00000000001BF000-memory.dmp

Filesize
188KB

Download
memory/1668-9-0x0000000000110000-0x0000000000130000-memory.dmp

Filesize
128KB

Download
memory/1668-17-0x0000000000110000-0x0000000000130000-memory.dmp

Filesize
128KB

Download