Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25-02-2024 08:18

General

  • Target

    a34e2338bdf8cfedcea9c598c6d6c11a.exe

  • Size

    719KB

  • MD5

    a34e2338bdf8cfedcea9c598c6d6c11a

  • SHA1

    7024c555d8ccf42b0f0e5efc89fad655ec3fc763

  • SHA256

    2b97646bf046edf22e0eed0afb148556116a9df5f60625a51305a36a8ae3fc5c

  • SHA512

    a1e3df1bd95a799d62edffe5267b153d46217608e59329c9ddb2b21fcec250dd1e63e83ba8bdb5d8bd38180f455e5b85a4403d33701176d5ca8b1da161528277

  • SSDEEP

    12288:HHTrEhAaJ/aeaxXPA1On5jw9T4EXe6d+T9YlfomJFud0IoSD2aQYth+L:HH3EiO/Ix/AcnS9Tv4T900dBoSD2aQf

Score
6/10

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a34e2338bdf8cfedcea9c598c6d6c11a.exe
    "C:\Users\Admin\AppData\Local\Temp\a34e2338bdf8cfedcea9c598c6d6c11a.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:2928

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2928-20-0x0000000005BC0000-0x0000000005BC1000-memory.dmp

    Filesize

    4KB

  • memory/2928-19-0x0000000005AD0000-0x0000000005AD1000-memory.dmp

    Filesize

    4KB

  • memory/2928-18-0x0000000001F20000-0x0000000001F21000-memory.dmp

    Filesize

    4KB

  • memory/2928-17-0x0000000005BF0000-0x0000000005BF1000-memory.dmp

    Filesize

    4KB

  • memory/2928-16-0x0000000005BD0000-0x0000000005BD1000-memory.dmp

    Filesize

    4KB

  • memory/2928-15-0x0000000005C30000-0x0000000005C31000-memory.dmp

    Filesize

    4KB

  • memory/2928-14-0x0000000005B60000-0x0000000005B62000-memory.dmp

    Filesize

    8KB

  • memory/2928-13-0x0000000005C10000-0x0000000005C11000-memory.dmp

    Filesize

    4KB

  • memory/2928-12-0x0000000005AE0000-0x0000000005AE1000-memory.dmp

    Filesize

    4KB

  • memory/2928-11-0x0000000005C50000-0x0000000005C51000-memory.dmp

    Filesize

    4KB

  • memory/2928-10-0x0000000005C00000-0x0000000005C01000-memory.dmp

    Filesize

    4KB

  • memory/2928-9-0x0000000005B90000-0x0000000005B91000-memory.dmp

    Filesize

    4KB

  • memory/2928-8-0x0000000005AF0000-0x0000000005AF1000-memory.dmp

    Filesize

    4KB

  • memory/2928-7-0x0000000005B40000-0x0000000005B41000-memory.dmp

    Filesize

    4KB

  • memory/2928-6-0x0000000005B30000-0x0000000005B31000-memory.dmp

    Filesize

    4KB

  • memory/2928-5-0x0000000005A60000-0x0000000005A61000-memory.dmp

    Filesize

    4KB

  • memory/2928-4-0x0000000005A70000-0x0000000005A71000-memory.dmp

    Filesize

    4KB

  • memory/2928-3-0x0000000005A80000-0x0000000005A82000-memory.dmp

    Filesize

    8KB

  • memory/2928-2-0x0000000005AB0000-0x0000000005AB1000-memory.dmp

    Filesize

    4KB

  • memory/2928-1-0x0000000005AC0000-0x0000000005AC1000-memory.dmp

    Filesize

    4KB

  • memory/2928-0-0x0000000000400000-0x00000000005A2000-memory.dmp

    Filesize

    1.6MB

  • memory/2928-21-0x0000000000400000-0x00000000005A2000-memory.dmp

    Filesize

    1.6MB

  • memory/2928-22-0x0000000000400000-0x00000000005A2000-memory.dmp

    Filesize

    1.6MB

  • memory/2928-23-0x0000000000400000-0x00000000005A2000-memory.dmp

    Filesize

    1.6MB

  • memory/2928-24-0x0000000000400000-0x00000000005A2000-memory.dmp

    Filesize

    1.6MB

  • memory/2928-25-0x0000000005B80000-0x0000000005B81000-memory.dmp

    Filesize

    4KB