1fd269e800ee008f26143e6b2880b7890c6f74abff65d8162c2e279d66441981

Analysis

max time kernel
141s
max time network
150s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 20:49

Target

1fd269e800ee008f26143e6b2880b7890c6f74abff65d8162c2e279d66441981.exe
Size

296KB
MD5

732c329022af10adbcab5913cdc8eb66
SHA1

1d091d85d00d54835df2f760d8c10cc4b988bf59
SHA256

1fd269e800ee008f26143e6b2880b7890c6f74abff65d8162c2e279d66441981
SHA512

1db58dacbb70798b82160a2a6267cf53a1e143511aca8755ad884be88ddaf53261f4759248aed2dc77db16fb2bb156ed3ca18fea4db3eb95386a621d9ae78a45
SSDEEP

6144:NQe7uTK0t+1RjLPvo2khl0bO9ulzkSnlrCPNw:NriWbRHPwVIkSnlC1w

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\FaceGenerator.job	1fd269e800ee008f26143e6b2880b7890c6f74abff65d8162c2e279d66441981.exe

C:\Users\Admin\AppData\Local\Temp\1fd269e800ee008f26143e6b2880b7890c6f74abff65d8162c2e279d66441981.exe
"C:\Users\Admin\AppData\Local\Temp\1fd269e800ee008f26143e6b2880b7890c6f74abff65d8162c2e279d66441981.exe"
1⤵
- Drops file in Windows directory
PID:1660

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1660-54-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download
memory/1660-55-0x0000000000380000-0x00000000003AF000-memory.dmp

Filesize
188KB

Download
memory/1660-59-0x00000000002F0000-0x0000000000322000-memory.dmp

Filesize
200KB

Download
memory/1660-60-0x00000000002F0000-0x0000000000322000-memory.dmp

Filesize
200KB

Download