5db8f7382c9685ac0ae62c1ee1cbe69607517079ccab56a8849ff00a75346a11

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 20:26

Target

5db8f7382c9685ac0ae62c1ee1cbe69607517079ccab56a8849ff00a75346a11.exe
Size

234KB
MD5

55797aa8dd2b5d792482b870f26bdc79
SHA1

f0382f80c4a9e83c86d416a39d37f3352164f808
SHA256

5db8f7382c9685ac0ae62c1ee1cbe69607517079ccab56a8849ff00a75346a11
SHA512

0e2a70ba2ab42ef282193cb38b701f6c6583e70d0b4e375c8910957d67d3622085225cef6528c3b8da9382746366662907ef88c2605617a5e84a452c183cc3c0
SSDEEP

3072:y9NabzspvYPwfEj+Cq+HEI2WW1U2Ucs1xsxssU++SUrm4fIAfwRYsa3GHS:ENkgpgAEaW3kacs3rslUrzH0YhGHS

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\BugFree.job	5db8f7382c9685ac0ae62c1ee1cbe69607517079ccab56a8849ff00a75346a11.exe

C:\Users\Admin\AppData\Local\Temp\5db8f7382c9685ac0ae62c1ee1cbe69607517079ccab56a8849ff00a75346a11.exe
"C:\Users\Admin\AppData\Local\Temp\5db8f7382c9685ac0ae62c1ee1cbe69607517079ccab56a8849ff00a75346a11.exe"
1⤵
- Drops file in Windows directory
PID:1368

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1368-54-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download
memory/1368-55-0x0000000000210000-0x000000000023F000-memory.dmp

Filesize
188KB

Download