2b3284230452e9d38c6d1832c98f3b37198f858d1d3cfcb4ead4996f5016b4eb

Analysis

Target

2b3284230452e9d38c6d1832c98f3b37198f858d1d3cfcb4ead4996f5016b4eb.exe
Size

149KB
MD5

03b8d1c184feeee8b8bf97e808251b5c
SHA1

68689df1b8ace15e8f8c90603f2f060c1d593b18
SHA256

2b3284230452e9d38c6d1832c98f3b37198f858d1d3cfcb4ead4996f5016b4eb
SHA512

26fcf7a05fcb0d5c562f5ef9af55b02c05e5482b77ffe597ec989803c0ebc3e4804322c9c760a2ffe89342a71da6596942b2bd4de0e8fd434fb9df15c075f034

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

2b3284230452e9d38c6d1832c98f3b37198f858d1d3cfcb4ead4996f5016b4eb.exe

pid	process
1772	2b3284230452e9d38c6d1832c98f3b37198f858d1d3cfcb4ead4996f5016b4eb.exe
1772	2b3284230452e9d38c6d1832c98f3b37198f858d1d3cfcb4ead4996f5016b4eb.exe

C:\Users\Admin\AppData\Local\Temp\2b3284230452e9d38c6d1832c98f3b37198f858d1d3cfcb4ead4996f5016b4eb.exe
"C:\Users\Admin\AppData\Local\Temp\2b3284230452e9d38c6d1832c98f3b37198f858d1d3cfcb4ead4996f5016b4eb.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1772

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1772-135-0x00000000001C0000-0x00000000001C3000-memory.dmp

Filesize
12KB

Download
memory/1772-131-0x0000000001000000-0x000000000102F000-memory.dmp

Filesize
188KB

Download
memory/1772-138-0x0000000001000000-0x000000000102F000-memory.dmp

Filesize
188KB

Download