b0e6fe799a6cb8b482ca22128800f314c90e431e3ac1f4e4b2d97b30ba81f74c

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 20:20

Target

b0e6fe799a6cb8b482ca22128800f314c90e431e3ac1f4e4b2d97b30ba81f74c.exe
Size

337KB
MD5

6845f7ce36e846e6a296fece2f57e267
SHA1

585e9e2403148303c902b2573d0d81a4809b776c
SHA256

b0e6fe799a6cb8b482ca22128800f314c90e431e3ac1f4e4b2d97b30ba81f74c
SHA512

4bb3ce2d16c0463fb9e90a0665cab6f970c3b0bef03058da5209d13acb9b2ffecb013096bb6f546604e0087ab225aa4a5aac2ac5aa6ac4b2b04e5bbcda896c55
SSDEEP

6144:u+vwKD3oNsxxmmJJT/sEm6666uM2qVyQKRCrnvzel:uuw0cs/T/7yWMLdvzel

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\AppBundles.job	b0e6fe799a6cb8b482ca22128800f314c90e431e3ac1f4e4b2d97b30ba81f74c.exe

C:\Users\Admin\AppData\Local\Temp\b0e6fe799a6cb8b482ca22128800f314c90e431e3ac1f4e4b2d97b30ba81f74c.exe
"C:\Users\Admin\AppData\Local\Temp\b0e6fe799a6cb8b482ca22128800f314c90e431e3ac1f4e4b2d97b30ba81f74c.exe"
1⤵
- Drops file in Windows directory
PID:1080

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1080-54-0x00000000758C1000-0x00000000758C3000-memory.dmp

Filesize
8KB

Download
memory/1080-55-0x0000000000290000-0x00000000002BF000-memory.dmp

Filesize
188KB

Download