756edc4c9dd0fae0a0e89602ba2acee30b5c4d6dbfc35dc5f18391d5b48f4025

Analysis

max time kernel
70s
max time network
85s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 13:32

Target

756edc4c9dd0fae0a0e89602ba2acee30b5c4d6dbfc35dc5f18391d5b48f4025.exe
Size

346KB
MD5

a06bcd41df718b36fd3979d14f1d631b
SHA1

ef128ca1e07cc5dc45a02cdeedca2eff1b452600
SHA256

756edc4c9dd0fae0a0e89602ba2acee30b5c4d6dbfc35dc5f18391d5b48f4025
SHA512

c3e0f63b52402984af2ff2e295a8c650f70a3f5ed33235e346db229bf36cff85a4e960423bff98784cb9a287fe1357117e82b29dd351bd1843b82cc2dbb8bc93
SSDEEP

6144:WJxABwCoIY2ozomNVHdgebRA+PIspeDq+7u92z6zdvGZf:WJxSw1/NVDIbY66zdvGZf

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\ContentDealer.job	756edc4c9dd0fae0a0e89602ba2acee30b5c4d6dbfc35dc5f18391d5b48f4025.exe

C:\Users\Admin\AppData\Local\Temp\756edc4c9dd0fae0a0e89602ba2acee30b5c4d6dbfc35dc5f18391d5b48f4025.exe
"C:\Users\Admin\AppData\Local\Temp\756edc4c9dd0fae0a0e89602ba2acee30b5c4d6dbfc35dc5f18391d5b48f4025.exe"
1⤵
- Drops file in Windows directory
PID:1492

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1492-54-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download
memory/1492-55-0x00000000003A0000-0x00000000003CF000-memory.dmp

Filesize
188KB

Download