b2b276a93d30b873d08562912f74698ff5d732158d1179fdd0770c3510affe9a

Analysis

max time kernel
61s
max time network
75s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 13:28

Target

b2b276a93d30b873d08562912f74698ff5d732158d1179fdd0770c3510affe9a.exe
Size

344KB
MD5

40bb0340341015935b06ab1a8ce3ed00
SHA1

ce26536a82c1546241647a3910058ec992d4e209
SHA256

b2b276a93d30b873d08562912f74698ff5d732158d1179fdd0770c3510affe9a
SHA512

b14ff1ec6ff083337f8c05e42bd7d641352e05e863d919522184ccc0e2d1a08ed6ff9e72134a4ebc44e67b676df84a4fcbda28cf8acab91b3369efdc32f74521
SSDEEP

6144:gB6rbeAqM5h8YoGjO0WNBHSq7LT52mBABnYBRQ:EQSfMv8YoGaI+LT5OBnYBRQ

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\SyncExist.job	b2b276a93d30b873d08562912f74698ff5d732158d1179fdd0770c3510affe9a.exe

C:\Users\Admin\AppData\Local\Temp\b2b276a93d30b873d08562912f74698ff5d732158d1179fdd0770c3510affe9a.exe
"C:\Users\Admin\AppData\Local\Temp\b2b276a93d30b873d08562912f74698ff5d732158d1179fdd0770c3510affe9a.exe"
1⤵
- Drops file in Windows directory
PID:1680

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1680-54-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download
memory/1680-55-0x0000000000390000-0x00000000003BF000-memory.dmp

Filesize
188KB

Download