515e96b0bc4238146d3e25d9bcded06fd8f48474710aee4a398ee1acf0d5bb67

Analysis

max time kernel
36s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-10-2022 02:05

Target

515e96b0bc4238146d3e25d9bcded06fd8f48474710aee4a398ee1acf0d5bb67.exe
Size

282KB
MD5

315aa686392472db927dd69a304bac20
SHA1

1697877e8ec579a0d7578c7b31d0b26591d8ea75
SHA256

515e96b0bc4238146d3e25d9bcded06fd8f48474710aee4a398ee1acf0d5bb67
SHA512

f11d3d85061f50670caf022b3cfa70b2c37ecf07adf38820c4b1f8727a6b794e6a01ff5b3fcdbe231d450b5869dec675b6dca835969664410d2a69800a9ab6a7
SSDEEP

3072:8jC9xRII+d1gYK7ExVnKNVOciYJwGVndlVIPGhMOdiV0vMMeG/zkaiZhRF:8O9UrgYK7EbK71VnlW2TeqgTRF

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\EventsEagle.job	515e96b0bc4238146d3e25d9bcded06fd8f48474710aee4a398ee1acf0d5bb67.exe

C:\Users\Admin\AppData\Local\Temp\515e96b0bc4238146d3e25d9bcded06fd8f48474710aee4a398ee1acf0d5bb67.exe
"C:\Users\Admin\AppData\Local\Temp\515e96b0bc4238146d3e25d9bcded06fd8f48474710aee4a398ee1acf0d5bb67.exe"
1⤵
- Drops file in Windows directory
PID:1720

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1720-54-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download
memory/1720-55-0x0000000000320000-0x000000000034F000-memory.dmp

Filesize
188KB

Download