05b3c1a923023caa0406913eca66e0122cc8728d742134717709dd0b4d2dbec8

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 17:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dfad1d17fecc0211be6ac31922c0f20f.exe
Size

316KB
MD5

dfad1d17fecc0211be6ac31922c0f20f
SHA1

bf9ce9f89f3565d4481509fab4cd5a5886766f9c
SHA256

05b3c1a923023caa0406913eca66e0122cc8728d742134717709dd0b4d2dbec8
SHA512

900630dfdfb130de8c6f7a1437376fddd0896d934961ce094ee963e08e6ab46a032f88a5945d9365988d51e0f9486f9322c8beebe05cbfe872469883f821d9ae
SSDEEP

3072:53ZuR2XXv9JRXOECRwwUT4ePTppt1yoZxyej5ot+/Bg1TYFlhmtPGSVBw+KfgTyC:5puR2H8aThYoL6I/BOT8m4SVBw+cnyJ

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\TimeSketch.job	dfad1d17fecc0211be6ac31922c0f20f.exe

C:\Users\Admin\AppData\Local\Temp\dfad1d17fecc0211be6ac31922c0f20f.exe
"C:\Users\Admin\AppData\Local\Temp\dfad1d17fecc0211be6ac31922c0f20f.exe"
1⤵
- Drops file in Windows directory
PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3024-9-0x0000000000110000-0x0000000000130000-memory.dmp

Filesize
128KB

Download
memory/3024-5-0x00000000001B0000-0x00000000001DF000-memory.dmp

Filesize
188KB

Download
memory/3024-4-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/3024-3-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/3024-2-0x0000000000110000-0x0000000000130000-memory.dmp

Filesize
128KB

Download
memory/3024-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/3024-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/3024-17-0x0000000000110000-0x0000000000130000-memory.dmp

Filesize
128KB

Download