f99b4f6519492ce583696bb4db661408bd5eccef02947f5ca66975069df6cf67

Analysis

max time kernel
66s
max time network
97s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 13:23

Target

f99b4f6519492ce583696bb4db661408bd5eccef02947f5ca66975069df6cf67.exe
Size

347KB
MD5

8151c6b15472ffc6cce0e35e84adf490
SHA1

16005bad2392ba6e5dcb53dc77baf42d7009bd70
SHA256

f99b4f6519492ce583696bb4db661408bd5eccef02947f5ca66975069df6cf67
SHA512

2a9692ae399ce9393e47e678accf6795f46c4f8839b9b1440deb6c5dff314a424e9c7cebd2e87ad68c0d2da86203166aa42bb70a7092359b556f397f50c35113
SSDEEP

6144:Q4loYeGF8B9St0mr76YtD0tX3B7ecQLnbAYpvJiBZxG4g9KOcgws:WYInEr76YatXRSfFpcZ5CZcgws

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\PocketSaver.job	f99b4f6519492ce583696bb4db661408bd5eccef02947f5ca66975069df6cf67.exe

C:\Users\Admin\AppData\Local\Temp\f99b4f6519492ce583696bb4db661408bd5eccef02947f5ca66975069df6cf67.exe
"C:\Users\Admin\AppData\Local\Temp\f99b4f6519492ce583696bb4db661408bd5eccef02947f5ca66975069df6cf67.exe"
1⤵
- Drops file in Windows directory
PID:1600

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1600-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1600-55-0x0000000000210000-0x000000000023F000-memory.dmp

Filesize
188KB

Download