d621d97831e2a442d03175a2e28891a919a3a8050148a7a23eba6ded01fadf07 | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20-01-2024 02:56

Sharing

Report Analysis Logs

General

Target

694ef8a7e4a932333f9947d4c8578203.exe
Size

20KB
MD5

694ef8a7e4a932333f9947d4c8578203
SHA1

55b7f40997311a0840ec202a8c0d092fece69abe
SHA256

d621d97831e2a442d03175a2e28891a919a3a8050148a7a23eba6ded01fadf07
SHA512

c62c425410a68f4a88c55ba8a69af475018b06bc4df1f6b7aa19f69eda5368b9780bb64e106c48b8a741099822e5125ee1dca2c19d7627c047269030336390c9
SSDEEP

384:S3bo2OsY/oBli+F3TrL0HLu5FA8JJQYvWA:S3Al/oBlig3/L0pIV7

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: RenamesItself 1 IoCs

Processes:

694ef8a7e4a932333f9947d4c8578203.exe

pid process

2828 694ef8a7e4a932333f9947d4c8578203.exe

C:\Users\Admin\AppData\Local\Temp\694ef8a7e4a932333f9947d4c8578203.exe
"C:\Users\Admin\AppData\Local\Temp\694ef8a7e4a932333f9947d4c8578203.exe"
1⤵
- Suspicious behavior: RenamesItself
PID:2828

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2828-0-0x0000000000230000-0x000000000023D000-memory.dmp

Filesize
52KB

Download