535f675de5de8a35c02e0fe0f774f040e7486353d27c964df3caad2b4f272eee

Analysis

Target

535f675de5de8a35c02e0fe0f774f040e7486353d27c964df3caad2b4f272eee.exe
Size

559KB
MD5

c812d46880cbf8133af73a693a91f72d
SHA1

fef611bb2b0137c4dcd0b9a7a00bff3bc8d29936
SHA256

535f675de5de8a35c02e0fe0f774f040e7486353d27c964df3caad2b4f272eee
SHA512

271ad2374cfde4bfe57eea7e81e195643dca8f14615b3e734bdaaa314897de02f13a891317cffdfab9155527412b3f2783a6532450cdab0ed3e5370c8943f6ea

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

535f675de5de8a35c02e0fe0f774f040e7486353d27c964df3caad2b4f272eee.exe

pid	process
1400	535f675de5de8a35c02e0fe0f774f040e7486353d27c964df3caad2b4f272eee.exe
1400	535f675de5de8a35c02e0fe0f774f040e7486353d27c964df3caad2b4f272eee.exe

C:\Users\Admin\AppData\Local\Temp\535f675de5de8a35c02e0fe0f774f040e7486353d27c964df3caad2b4f272eee.exe
"C:\Users\Admin\AppData\Local\Temp\535f675de5de8a35c02e0fe0f774f040e7486353d27c964df3caad2b4f272eee.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1400

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Exfiltration

Command and Control

Impact