85b6542124079af324521212625383dec64ba4c8476c3148828e07e64853a1f9

Analysis

max time kernel
43s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11-10-2022 18:05

Target

85b6542124079af324521212625383dec64ba4c8476c3148828e07e64853a1f9.exe
Size

283KB
MD5

51a534e841d4589d0cbb1c29aecac170
SHA1

739897d06e31c03775fc296a95cbcf9817ca388d
SHA256

85b6542124079af324521212625383dec64ba4c8476c3148828e07e64853a1f9
SHA512

9ee680f8945c843df8fb29b0d7b81bcee4b849dbf1860d29fb3bb9328884a4c69b9bd52845f93fd5c591572295f3e097ad4ff7e7be908a24a44298a03d44c140
SSDEEP

3072:St89AWLBDUsxrgBeWdgwdhy7LanzWtqtiagbD26BvWwQow5ueVEzL1WuqYfLfnYG:ofwg0W7HyqAagbDHQ55fEpfLvFZGo

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\TowerPower.job	85b6542124079af324521212625383dec64ba4c8476c3148828e07e64853a1f9.exe

C:\Users\Admin\AppData\Local\Temp\85b6542124079af324521212625383dec64ba4c8476c3148828e07e64853a1f9.exe
"C:\Users\Admin\AppData\Local\Temp\85b6542124079af324521212625383dec64ba4c8476c3148828e07e64853a1f9.exe"
1⤵
- Drops file in Windows directory
PID:1200

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1200-54-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/1200-55-0x00000000000F0000-0x000000000011F000-memory.dmp

Filesize
188KB

Download
memory/1200-59-0x00000000001B1000-0x00000000001D2000-memory.dmp

Filesize
132KB

Download