7907bd70d96ef9287548d8569147b8158ed4641718a0a9358e08d005e22fae55

Analysis

max time kernel
40s
max time network
79s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 13:23

Target

7907bd70d96ef9287548d8569147b8158ed4641718a0a9358e08d005e22fae55.exe
Size

188KB
MD5

2f1758810daa59de0f78bb754fb621f0
SHA1

284a36d858cb86b559d27124686be198ec8601b3
SHA256

7907bd70d96ef9287548d8569147b8158ed4641718a0a9358e08d005e22fae55
SHA512

3a6d96c33484bc13134c2a482bc31177982266f435dc654a433cb399cc23b9aff0e3b363cf1d1e20b75609eeb0f74546852712144d06870ceabb909beec6f2cf
SSDEEP

3072:nRRPtQVB9UkuLjRqBhXbxxiWQVQrlakHYqxfViyp2sdmQQa:DPiVzuj8BBLTxrlatMVua

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\SaveMail.job	7907bd70d96ef9287548d8569147b8158ed4641718a0a9358e08d005e22fae55.exe

C:\Users\Admin\AppData\Local\Temp\7907bd70d96ef9287548d8569147b8158ed4641718a0a9358e08d005e22fae55.exe
"C:\Users\Admin\AppData\Local\Temp\7907bd70d96ef9287548d8569147b8158ed4641718a0a9358e08d005e22fae55.exe"
1⤵
- Drops file in Windows directory
PID:2004

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2004-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/2004-55-0x00000000001B0000-0x00000000001DF000-memory.dmp

Filesize
188KB

Download
memory/2004-59-0x0000000000020000-0x0000000000040000-memory.dmp

Filesize
128KB

Download
memory/2004-60-0x0000000000020000-0x0000000000040000-memory.dmp

Filesize
128KB

Download