e90d1ac7f8289fd672925e275f2de2d412d7996281f0f2c49432ebdd716f21bf

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 23:36

Target

e90d1ac7f8289fd672925e275f2de2d412d7996281f0f2c49432ebdd716f21bf.exe
Size

188KB
MD5

6d57e40290006407242cce8d68229180
SHA1

d83638a00c224225720e876370d33e4a65abd50f
SHA256

e90d1ac7f8289fd672925e275f2de2d412d7996281f0f2c49432ebdd716f21bf
SHA512

56e6713b9972eac0cea91bef489fab0cc83056b808ca4e0367429720f7282bc281e73a2ee36782ddfed996dfe653a9df05a264d3b91a0fb0282ad1eff1927d5f
SSDEEP

3072:j+ht6tGUHrJtnSvUAHP42i5/NaJgS/jfeT4AhQIRh2srmk/3j5w:1oUHrJtnSvl42EUzKTAIDFj5w

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\WorkOwl.job	e90d1ac7f8289fd672925e275f2de2d412d7996281f0f2c49432ebdd716f21bf.exe

C:\Users\Admin\AppData\Local\Temp\e90d1ac7f8289fd672925e275f2de2d412d7996281f0f2c49432ebdd716f21bf.exe
"C:\Users\Admin\AppData\Local\Temp\e90d1ac7f8289fd672925e275f2de2d412d7996281f0f2c49432ebdd716f21bf.exe"
1⤵
- Drops file in Windows directory
PID:1092

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1092-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/1092-55-0x0000000000110000-0x000000000013F000-memory.dmp

Filesize
188KB

Download
memory/1092-59-0x0000000000020000-0x0000000000040000-memory.dmp

Filesize
128KB

Download
memory/1092-60-0x0000000000020000-0x0000000000040000-memory.dmp

Filesize
128KB

Download