bf0de3bd38e086901c7612ce79b6b4ea4a83cb8fc7ad82d6f09bc4e6d48e76fe

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 13:27

Target

bf0de3bd38e086901c7612ce79b6b4ea4a83cb8fc7ad82d6f09bc4e6d48e76fe.exe
Size

293KB
MD5

96cec36e3219ae8a9905aa4eb95797d3
SHA1

8ebea0f74566a4f1165abddf2b186c0a52f44d8d
SHA256

bf0de3bd38e086901c7612ce79b6b4ea4a83cb8fc7ad82d6f09bc4e6d48e76fe
SHA512

c5c7863a3689ea9266573bf5b1994ea693487f70609ba42416b2c75c73d231a2e81796ff5e96928bb7d7bc99a8e7dea14fbf40f2dddf9f7314151eaa3569ef75
SSDEEP

6144:4GAqM2U0lT9aSuX+NX8tDxpqBqyGDLbVvlj:4GDgv7X+NXATqIb/Vvlj

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\SecurityBoost.job	bf0de3bd38e086901c7612ce79b6b4ea4a83cb8fc7ad82d6f09bc4e6d48e76fe.exe

C:\Users\Admin\AppData\Local\Temp\bf0de3bd38e086901c7612ce79b6b4ea4a83cb8fc7ad82d6f09bc4e6d48e76fe.exe
"C:\Users\Admin\AppData\Local\Temp\bf0de3bd38e086901c7612ce79b6b4ea4a83cb8fc7ad82d6f09bc4e6d48e76fe.exe"
1⤵
- Drops file in Windows directory
PID:2028

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2028-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/2028-55-0x00000000001B0000-0x00000000001DF000-memory.dmp

Filesize
188KB

Download