0ba1c9c97a40f1b2be0f4d51ef8ec6466c6bf5c38711cc222f949c8b3445ee01

Analysis

max time kernel
141s
max time network
153s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 13:22

Target

0ba1c9c97a40f1b2be0f4d51ef8ec6466c6bf5c38711cc222f949c8b3445ee01.exe
Size

281KB
MD5

783b49ff9225f3e8e8a2135ebcdd3208
SHA1

730ee0082015d986b4c9a4f77e5d117b2a7ccac1
SHA256

0ba1c9c97a40f1b2be0f4d51ef8ec6466c6bf5c38711cc222f949c8b3445ee01
SHA512

2aace9745f353c16eeb92760c4843904b735ecc3b9068e998ad7f23bf4af741f6d514355e8e699199559a3b24085eaf97a79481cb212b703be85061277f9e6f8
SSDEEP

6144:qWGyOrP4KjIndreKuBWE29MpF7Ty0iC9xbcg:qWDO5IndI29wTy0iCcg

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\FastTasks.job	0ba1c9c97a40f1b2be0f4d51ef8ec6466c6bf5c38711cc222f949c8b3445ee01.exe

C:\Users\Admin\AppData\Local\Temp\0ba1c9c97a40f1b2be0f4d51ef8ec6466c6bf5c38711cc222f949c8b3445ee01.exe
"C:\Users\Admin\AppData\Local\Temp\0ba1c9c97a40f1b2be0f4d51ef8ec6466c6bf5c38711cc222f949c8b3445ee01.exe"
1⤵
- Drops file in Windows directory
PID:1564

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1564-54-0x0000000075681000-0x0000000075683000-memory.dmp

Filesize
8KB

Download
memory/1564-55-0x0000000000350000-0x000000000037F000-memory.dmp

Filesize
188KB

Download