56129a81dd7435f22336e5effb1ec8e9122dc891752e7ad995ad70926290d044

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
25-07-2022 05:56

Target

56129a81dd7435f22336e5effb1ec8e9122dc891752e7ad995ad70926290d044.exe
Size

219KB
MD5

449ed29c7297b3aa6d0e1a5df590dfa2
SHA1

f5701ba8841217eb64c1bdcdf51f3b767b3b447d
SHA256

56129a81dd7435f22336e5effb1ec8e9122dc891752e7ad995ad70926290d044
SHA512

6bff2f0a9e3eafb598241e038cefb1ecc88d8fa6fee9fb4c36e68ecf4f33e8fb30a556964c5d6bdee6f1ad6a0b4cf0f2b7996e26418a8f22fbd32534c654891f

Score

10^/10

suricata: ET MALWARE ETag HTTP Header Observed at JPCERT Sinkhole
suricata: ET MALWARE ETag HTTP Header Observed at JPCERT Sinkhole
suricata
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops file in Windows directory 1 IoCs

Processes:

56129a81dd7435f22336e5effb1ec8e9122dc891752e7ad995ad70926290d044.exe

description ioc process

File created C:\Windows\Tasks\SociaLite.job 56129a81dd7435f22336e5effb1ec8e9122dc891752e7ad995ad70926290d044.exe

description	ioc	process
File created	C:\Windows\Tasks\SociaLite.job	56129a81dd7435f22336e5effb1ec8e9122dc891752e7ad995ad70926290d044.exe

C:\Users\Admin\AppData\Local\Temp\56129a81dd7435f22336e5effb1ec8e9122dc891752e7ad995ad70926290d044.exe
"C:\Users\Admin\AppData\Local\Temp\56129a81dd7435f22336e5effb1ec8e9122dc891752e7ad995ad70926290d044.exe"
1⤵
- Drops file in Windows directory
PID:852

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/852-54-0x0000000075511000-0x0000000075513000-memory.dmp

Filesize
8KB

Download
memory/852-55-0x00000000001B0000-0x00000000001DF000-memory.dmp

Filesize
188KB

Download