e5d8ba0b605329c17a70963a2127f0b46e80b37fdccda9bc9de895c9f0d207e3

Analysis

max time kernel
29s
max time network
167s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 13:24

Target

e5d8ba0b605329c17a70963a2127f0b46e80b37fdccda9bc9de895c9f0d207e3.exe
Size

305KB
MD5

534127a04735d5a1bffdaf6e77c9b86d
SHA1

bedd2400130c6f229a79c9de5dc084efa3f57deb
SHA256

e5d8ba0b605329c17a70963a2127f0b46e80b37fdccda9bc9de895c9f0d207e3
SHA512

e17e479734e0f45fbe492681a831783ebfe8987a3ec57fe614171b3e23fe0906b567906b66c08d9ec2e5b38f62fe5dbf40eb6673f2cc399d23d87dbe1d1564f8
SSDEEP

6144:CEZWyBLBwomp012QRPBxXZoR+bT+830WOuK/nN6yX:CEAELM0AQ5BxXZoR+OC0WyNJX

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\TruFilters.job	e5d8ba0b605329c17a70963a2127f0b46e80b37fdccda9bc9de895c9f0d207e3.exe

C:\Users\Admin\AppData\Local\Temp\e5d8ba0b605329c17a70963a2127f0b46e80b37fdccda9bc9de895c9f0d207e3.exe
"C:\Users\Admin\AppData\Local\Temp\e5d8ba0b605329c17a70963a2127f0b46e80b37fdccda9bc9de895c9f0d207e3.exe"
1⤵
- Drops file in Windows directory
PID:2036

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2036-54-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download
memory/2036-55-0x0000000000160000-0x0000000000192000-memory.dmp

Filesize
200KB

Download
memory/2036-56-0x0000000000880000-0x00000000008AF000-memory.dmp

Filesize
188KB

Download
memory/2036-60-0x0000000000160000-0x0000000000192000-memory.dmp

Filesize
200KB

Download