56995312d620081f1d311fd96f5e893799785fd4a948fd7d13c4180353851e60

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
25-07-2022 02:23

Target

56995312d620081f1d311fd96f5e893799785fd4a948fd7d13c4180353851e60.exe
Size

182KB
MD5

2cd22f186f4b1dec8962b05719fc8a63
SHA1

920ca4f5281079ea5979d0949e36ae6bf6a67369
SHA256

56995312d620081f1d311fd96f5e893799785fd4a948fd7d13c4180353851e60
SHA512

8ccb821811265f34cd167116090494934cf3ce28b5b2797c1265d40aa21a064d9339682d1efe789d367b583e85cfc9b9b9c31911182d4c5de263b0f8f720612a

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

Processes:

56995312d620081f1d311fd96f5e893799785fd4a948fd7d13c4180353851e60.exe

description	ioc	process
File created	C:\Windows\Tasks\Bidaily Synchronize Task[973b].job	56995312d620081f1d311fd96f5e893799785fd4a948fd7d13c4180353851e60.exe

C:\Users\Admin\AppData\Local\Temp\56995312d620081f1d311fd96f5e893799785fd4a948fd7d13c4180353851e60.exe
"C:\Users\Admin\AppData\Local\Temp\56995312d620081f1d311fd96f5e893799785fd4a948fd7d13c4180353851e60.exe"
1⤵
- Drops file in Windows directory
PID:1124

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/1124-54-0x0000000075871000-0x0000000075873000-memory.dmp

Filesize
8KB

Download
memory/1124-55-0x0000000000110000-0x000000000013F000-memory.dmp

Filesize
188KB

Download
memory/1124-59-0x0000000000020000-0x0000000000040000-memory.dmp

Filesize
128KB

Download
memory/1124-60-0x0000000000020000-0x0000000000040000-memory.dmp

Filesize
128KB

Download