478f86e31c4bd8bd6ccf86696375949029d20f6736c4e01c577e99adec0c112d

Analysis

Target

478f86e31c4bd8bd6ccf86696375949029d20f6736c4e01c577e99adec0c112d.exe
Size

1.3MB
MD5

b3aa7897f91d154448ca43c228ae7a8e
SHA1

868f706493b869c092f2ff921fad6951d2a43574
SHA256

478f86e31c4bd8bd6ccf86696375949029d20f6736c4e01c577e99adec0c112d
SHA512

9cfc8df57b1ac632e338c67fefb94e9e34c6020662c510b9ece38f9ddc7f1af8b29639c197648e6553865d8c4b9782bfca557ae577552d1dba000e175d6d3552

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

478f86e31c4bd8bd6ccf86696375949029d20f6736c4e01c577e99adec0c112d.exe

pid	process
1684	478f86e31c4bd8bd6ccf86696375949029d20f6736c4e01c577e99adec0c112d.exe
1684	478f86e31c4bd8bd6ccf86696375949029d20f6736c4e01c577e99adec0c112d.exe

C:\Users\Admin\AppData\Local\Temp\478f86e31c4bd8bd6ccf86696375949029d20f6736c4e01c577e99adec0c112d.exe
"C:\Users\Admin\AppData\Local\Temp\478f86e31c4bd8bd6ccf86696375949029d20f6736c4e01c577e99adec0c112d.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1684

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Exfiltration

Command and Control

Impact