512ef5b78853a7bd0ad987c23e1eb1a743fb47f12fef24c02d721f5865de0961

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
18-07-2022 17:16

Target

512ef5b78853a7bd0ad987c23e1eb1a743fb47f12fef24c02d721f5865de0961.exe
Size

165KB
MD5

09cdec5540b9f8a2edc9f0036932270b
SHA1

d6d521ddffbc81b7bbdd807611f06f21f4029d5f
SHA256

512ef5b78853a7bd0ad987c23e1eb1a743fb47f12fef24c02d721f5865de0961
SHA512

e97326d10f904dc804bb1d04b151f7ec985ef325820af3466c5279db08bbe5a162c74d2c81417560c9d93b48998705863fe36c88de44e76ef759e07e569dad5a

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

512ef5b78853a7bd0ad987c23e1eb1a743fb47f12fef24c02d721f5865de0961.exe

pid	process
1216	512ef5b78853a7bd0ad987c23e1eb1a743fb47f12fef24c02d721f5865de0961.exe
1216	512ef5b78853a7bd0ad987c23e1eb1a743fb47f12fef24c02d721f5865de0961.exe

C:\Users\Admin\AppData\Local\Temp\512ef5b78853a7bd0ad987c23e1eb1a743fb47f12fef24c02d721f5865de0961.exe
"C:\Users\Admin\AppData\Local\Temp\512ef5b78853a7bd0ad987c23e1eb1a743fb47f12fef24c02d721f5865de0961.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1216

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/1216-130-0x0000000001000000-0x0000000001034000-memory.dmp

Filesize
208KB

Download
memory/1216-131-0x0000000001000000-0x0000000001034000-memory.dmp

Filesize
208KB

Download
memory/1216-137-0x0000000000690000-0x0000000000693000-memory.dmp

Filesize
12KB

Download
memory/1216-138-0x0000000001000000-0x0000000001034000-memory.dmp

Filesize
208KB

Download