4f28df73dc04055cef9f6f6e0e35bd8d5d81db48c62f9df7104b491698b88ba9

Analysis

Target

4f28df73dc04055cef9f6f6e0e35bd8d5d81db48c62f9df7104b491698b88ba9.exe
Size

531KB
MD5

f4ca6a96995babf43fc02715b793e8aa
SHA1

ad81f636c55121f6d1e22bb90716030da64fbd15
SHA256

4f28df73dc04055cef9f6f6e0e35bd8d5d81db48c62f9df7104b491698b88ba9
SHA512

1136751eb5c6b61390247e20b3bba61e351ae2ec1cdd97c694518f9a8d6c11399fca3d6705b0bbf256477ea9f8a14616c3dc665a4924d3026127537ca2497be9

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

4f28df73dc04055cef9f6f6e0e35bd8d5d81db48c62f9df7104b491698b88ba9.exe

pid	process
576	4f28df73dc04055cef9f6f6e0e35bd8d5d81db48c62f9df7104b491698b88ba9.exe
576	4f28df73dc04055cef9f6f6e0e35bd8d5d81db48c62f9df7104b491698b88ba9.exe

C:\Users\Admin\AppData\Local\Temp\4f28df73dc04055cef9f6f6e0e35bd8d5d81db48c62f9df7104b491698b88ba9.exe
"C:\Users\Admin\AppData\Local\Temp\4f28df73dc04055cef9f6f6e0e35bd8d5d81db48c62f9df7104b491698b88ba9.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:576

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Exfiltration

Command and Control

Impact