db13d8d0ac316c94c35c5b3b214e959a1378ced1fefcc430bff7510c63d133f8

Analysis

max time kernel
83s
max time network
91s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/10/2022, 18:22

Target

db13d8d0ac316c94c35c5b3b214e959a1378ced1fefcc430bff7510c63d133f8.exe
Size

296KB
MD5

736ff055c7cfee1e4a68740c56cb1b3a
SHA1

b0f446d7964c7f2e9e2726f898d347d2c6b35fca
SHA256

db13d8d0ac316c94c35c5b3b214e959a1378ced1fefcc430bff7510c63d133f8
SHA512

c7d9b4d7ce3058e1dc89174674bb938dfdb18533212308fc4919dc8dd3b9d96dcca5d1b407cef162d36ea19d539fb26e9d4de41b9abf1c455af6dca7b1541e64
SSDEEP

6144:qwTuErE+oO0nerk66VgyrWxqNb9UWtSobzfRFyg:qwovewLPNb9zt1bDOg

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\AlarmSystems.job	db13d8d0ac316c94c35c5b3b214e959a1378ced1fefcc430bff7510c63d133f8.exe

C:\Users\Admin\AppData\Local\Temp\db13d8d0ac316c94c35c5b3b214e959a1378ced1fefcc430bff7510c63d133f8.exe
"C:\Users\Admin\AppData\Local\Temp\db13d8d0ac316c94c35c5b3b214e959a1378ced1fefcc430bff7510c63d133f8.exe"
1⤵
- Drops file in Windows directory
PID:1188

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1188-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1188-55-0x0000000000160000-0x0000000000192000-memory.dmp

Filesize
200KB

Download
memory/1188-56-0x0000000000280000-0x00000000002AF000-memory.dmp

Filesize
188KB

Download
memory/1188-60-0x0000000000160000-0x0000000000192000-memory.dmp

Filesize
200KB

Download