421d17492ba24bfafd0e415236d54314d0b780d866ca7844f8be853610b4c88a

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 13:36

Target

421d17492ba24bfafd0e415236d54314d0b780d866ca7844f8be853610b4c88a.exe
Size

323KB
MD5

8163601291c34e304d9614252e2bc152
SHA1

1f57465a28565730037e952bd06f3f3bc6bdfa6c
SHA256

421d17492ba24bfafd0e415236d54314d0b780d866ca7844f8be853610b4c88a
SHA512

c1f61820b71adc5fd34feb01364ed2f85a9a19adb187474d78ba68587f0dc0b2a1ebbffce24380226c972fb1c4b73e979b032f3dbf3b0978e83d8828e6a0e6cd
SSDEEP

6144:+gwMEtG7zR+VPOmY8eV2QDVqV8ci5UJkgK52DAFWi:+gwMlU8JDQfZ62DAWi

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\EnviroNoise.job	421d17492ba24bfafd0e415236d54314d0b780d866ca7844f8be853610b4c88a.exe

C:\Users\Admin\AppData\Local\Temp\421d17492ba24bfafd0e415236d54314d0b780d866ca7844f8be853610b4c88a.exe
"C:\Users\Admin\AppData\Local\Temp\421d17492ba24bfafd0e415236d54314d0b780d866ca7844f8be853610b4c88a.exe"
1⤵
- Drops file in Windows directory
PID:1552

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1552-54-0x0000000075681000-0x0000000075683000-memory.dmp

Filesize
8KB

Download
memory/1552-55-0x00000000003A0000-0x00000000003CF000-memory.dmp

Filesize
188KB

Download