20789097bb9938eb0bf9972453ac6eb8a6eb1df6122169d30241495bb43ac831

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 23:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4763b43abfc4f320e10100a5079219cd.exe
Size

208KB
MD5

4763b43abfc4f320e10100a5079219cd
SHA1

cef0c266d8bdb1bb45bdd755b24ca2bf7532847f
SHA256

20789097bb9938eb0bf9972453ac6eb8a6eb1df6122169d30241495bb43ac831
SHA512

9e6efd7fa165753ee14334954f6f3c7f30365145dfd222d5b5bb8237076686364a846c9ee9b3abc0678d7b7adb7f33e2d0ef8744a30726d21438b4151005d2fc
SSDEEP

6144:WV0x23xws57KzAABc8vnHO9k95IoO7Y5fE9Hk:80gBIAMO9k9A72E9Hk

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\EasyFlight.job	4763b43abfc4f320e10100a5079219cd.exe

C:\Users\Admin\AppData\Local\Temp\4763b43abfc4f320e10100a5079219cd.exe
"C:\Users\Admin\AppData\Local\Temp\4763b43abfc4f320e10100a5079219cd.exe"
1⤵
- Drops file in Windows directory
PID:1888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1888-1-0x0000000000CF0000-0x0000000000D30000-memory.dmp

Filesize
256KB

Download
memory/1888-3-0x0000000000A90000-0x0000000000AD0000-memory.dmp

Filesize
256KB

Download
memory/1888-0-0x0000000000AE0000-0x0000000000B20000-memory.dmp

Filesize
256KB

Download
memory/1888-4-0x00000000000F0000-0x000000000011F000-memory.dmp

Filesize
188KB

Download