3bafe71156afa7de3a2d42b001b8422b490da582b12181bb015c7ee77d32bf22

Analysis

max time kernel
23s
max time network
58s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 16:57

Target

3bafe71156afa7de3a2d42b001b8422b490da582b12181bb015c7ee77d32bf22.exe
Size

188KB
MD5

a05245284e42f35bf434f54d0c638130
SHA1

02e9b2a7e40a3f07c2e8868dde15414cb4269265
SHA256

3bafe71156afa7de3a2d42b001b8422b490da582b12181bb015c7ee77d32bf22
SHA512

a113ad55dd4f435aa6170980e0ad61384dabe4e5c7e55ee924ef7bc32176b0facb6176a02320630e69df8e33b4b10c82719e870edcf9149df1a6dcc0ee283f92
SSDEEP

3072:FejhutbXmKqe9eQXk2Se0xCcaK+HceABsemLxQLz:0olXmKfU2nICPKQ6z

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\PersonalBar.job	3bafe71156afa7de3a2d42b001b8422b490da582b12181bb015c7ee77d32bf22.exe

C:\Users\Admin\AppData\Local\Temp\3bafe71156afa7de3a2d42b001b8422b490da582b12181bb015c7ee77d32bf22.exe
"C:\Users\Admin\AppData\Local\Temp\3bafe71156afa7de3a2d42b001b8422b490da582b12181bb015c7ee77d32bf22.exe"
1⤵
- Drops file in Windows directory
PID:1256

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1256-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/1256-55-0x0000000000220000-0x000000000024F000-memory.dmp

Filesize
188KB

Download
memory/1256-59-0x0000000000020000-0x0000000000040000-memory.dmp

Filesize
128KB

Download
memory/1256-60-0x0000000000020000-0x0000000000040000-memory.dmp

Filesize
128KB

Download