401473e5a7713b9b808acb109ad7c67ae5720ede54a37c200b42cf3d72d1689a

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/10/2022, 18:46

Target

401473e5a7713b9b808acb109ad7c67ae5720ede54a37c200b42cf3d72d1689a.exe
Size

297KB
MD5

61a522e088b6af7b91fbc8d31f3054ea
SHA1

e9bf3526450f0c131fbb84c6873ed67ea4ef0a39
SHA256

401473e5a7713b9b808acb109ad7c67ae5720ede54a37c200b42cf3d72d1689a
SHA512

c1484160d94d9f3102d2f67fa2c49df0f4e2970a887298a645db6adc5871076e8db5fa98d5446555b144f5dd2447ab6e03927fbcc299ef8008a72c095422e85d
SSDEEP

6144:pp3UVgTMym0j0VEDZDRmw0A9pFs+izkzcu:3UiM8Tmwtvcu

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\EffectiveNap.job	401473e5a7713b9b808acb109ad7c67ae5720ede54a37c200b42cf3d72d1689a.exe

C:\Users\Admin\AppData\Local\Temp\401473e5a7713b9b808acb109ad7c67ae5720ede54a37c200b42cf3d72d1689a.exe
"C:\Users\Admin\AppData\Local\Temp\401473e5a7713b9b808acb109ad7c67ae5720ede54a37c200b42cf3d72d1689a.exe"
1⤵
- Drops file in Windows directory
PID:1976

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1976-54-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1976-55-0x0000000000160000-0x0000000000193000-memory.dmp

Filesize
204KB

Download
memory/1976-56-0x0000000000280000-0x00000000002AF000-memory.dmp

Filesize
188KB

Download
memory/1976-60-0x0000000000160000-0x0000000000193000-memory.dmp

Filesize
204KB

Download