b5b1cb576dfc1c0098ae5c859f55fd77bfd59b2371aa66852ce66c034b868629

Analysis

max time kernel
34s
max time network
140s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-10-2022 18:25

Target

b5b1cb576dfc1c0098ae5c859f55fd77bfd59b2371aa66852ce66c034b868629.exe
Size

296KB
MD5

614a31dec3f467d660cfc2e7155e6be2
SHA1

9ee2fc8239590c7c72ce95910a5c1b4a395f0dcb
SHA256

b5b1cb576dfc1c0098ae5c859f55fd77bfd59b2371aa66852ce66c034b868629
SHA512

943d6876648f92c59e042362729a183dadf981ae666a62f4a4847846d91ca2ef2a3c09f3962a9b619602052c1aa51b359d9ebe9398a20900ebeb94bed759b9bc
SSDEEP

6144:HKg9ZZolJ0TIA4UDntYqRTasfV8T8SAGH:HKK94in6cvfV8T88H

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\BackupPlan.job	b5b1cb576dfc1c0098ae5c859f55fd77bfd59b2371aa66852ce66c034b868629.exe

C:\Users\Admin\AppData\Local\Temp\b5b1cb576dfc1c0098ae5c859f55fd77bfd59b2371aa66852ce66c034b868629.exe
"C:\Users\Admin\AppData\Local\Temp\b5b1cb576dfc1c0098ae5c859f55fd77bfd59b2371aa66852ce66c034b868629.exe"
1⤵
- Drops file in Windows directory
PID:1348

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1348-54-0x0000000074F41000-0x0000000074F43000-memory.dmp

Filesize
8KB

Download
memory/1348-55-0x00000000001E0000-0x0000000000212000-memory.dmp

Filesize
200KB

Download
memory/1348-56-0x00000000003B0000-0x00000000003DF000-memory.dmp

Filesize
188KB

Download
memory/1348-60-0x00000000001E0000-0x0000000000212000-memory.dmp

Filesize
200KB

Download