33eb19c4433776e479bfea1aff45927236149376d35c3a3090469c4d0000b815

Analysis

max time kernel
42s
max time network
51s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/10/2022, 18:34

Target

33eb19c4433776e479bfea1aff45927236149376d35c3a3090469c4d0000b815.exe
Size

294KB
MD5

75fb56d35a72c5f01f4b1870f0b56a40
SHA1

45068e6e67d13ac80ecdd96f41bea01434bfd832
SHA256

33eb19c4433776e479bfea1aff45927236149376d35c3a3090469c4d0000b815
SHA512

b1c2b9e1fa6e84548a7f9234c52cc447f4aca43f305db23b9e4be4a310d66e989f37ba9f086fae324a122e2477575c4f1c780ffbd07f6e4d132c86dbcd797685
SSDEEP

6144:56z5B71yhCVeThl14csOFT+veNQZ4mC1NyE+1gVkt:5Q5OhCY7K8LNq4md1+kt

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\ThinkSync.job	33eb19c4433776e479bfea1aff45927236149376d35c3a3090469c4d0000b815.exe

C:\Users\Admin\AppData\Local\Temp\33eb19c4433776e479bfea1aff45927236149376d35c3a3090469c4d0000b815.exe
"C:\Users\Admin\AppData\Local\Temp\33eb19c4433776e479bfea1aff45927236149376d35c3a3090469c4d0000b815.exe"
1⤵
- Drops file in Windows directory
PID:1036

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1036-54-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/1036-55-0x0000000000330000-0x000000000035F000-memory.dmp

Filesize
188KB

Download