6025628f24e4447063e9065387c872ae046b52dd86fd58efcd3d658f7872e1c8

Analysis

max time kernel
36s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 16:06

Target

6025628f24e4447063e9065387c872ae046b52dd86fd58efcd3d658f7872e1c8.exe
Size

187KB
MD5

1fca8fc420c27c340f3aaeeab49614e0
SHA1

b8c5960b1a608b62c82c07953f0e5ec30a4895c9
SHA256

6025628f24e4447063e9065387c872ae046b52dd86fd58efcd3d658f7872e1c8
SHA512

0aa09617eee8ed61fe48744d5e9bd1642a36a055cad633969186eefc299e291696c9886975f6ca77f952c148f40976ea6cb9f3e71425a4b0023bafd679313215
SSDEEP

3072:6V7zJteq4ecXsXs3/FQsbJjc7uP+IpELxFeAS/DJj8x6Rt12sCQFfjcz6:E7zJolBj3/FtdlPAfeAODJj8UdqQpS6

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\DrawerSorter.job	6025628f24e4447063e9065387c872ae046b52dd86fd58efcd3d658f7872e1c8.exe

C:\Users\Admin\AppData\Local\Temp\6025628f24e4447063e9065387c872ae046b52dd86fd58efcd3d658f7872e1c8.exe
"C:\Users\Admin\AppData\Local\Temp\6025628f24e4447063e9065387c872ae046b52dd86fd58efcd3d658f7872e1c8.exe"
1⤵
- Drops file in Windows directory
PID:1976

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1976-54-0x00000000762B1000-0x00000000762B3000-memory.dmp

Filesize
8KB

Download
memory/1976-55-0x0000000000020000-0x0000000000040000-memory.dmp

Filesize
128KB

Download
memory/1976-56-0x0000000000110000-0x000000000013F000-memory.dmp

Filesize
188KB

Download
memory/1976-60-0x0000000000020000-0x0000000000040000-memory.dmp

Filesize
128KB

Download