0f2c448822659513e8d22d0e6b2bab9d018bffe9f668284b08132d9adb8e3f15

Analysis

max time kernel
47s
max time network
126s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28/10/2022, 20:50

Target

0f2c448822659513e8d22d0e6b2bab9d018bffe9f668284b08132d9adb8e3f15.exe
Size

305KB
MD5

089cab280f223f9b395bc458b2f8c22b
SHA1

f85d37a0073c1296324b2d8b493e76a617b54a69
SHA256

0f2c448822659513e8d22d0e6b2bab9d018bffe9f668284b08132d9adb8e3f15
SHA512

5353cea1671153336fbdd51d7c6478fc1f4cd341ad67a7f0ae046574ec524d29d0d3ad9e1654ac41608e1f67c6fa3586cbc833125e6dca86bf29cdc3e472db7c
SSDEEP

6144:rrPX1Z/qJvcVrTbDUVJjS/K36gw+v68sCndfWfx06DHbtSIgufCy8qO:nPf/qiVTMSC3C+dfWfbDHbtSIgufr8qO

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\HDProtect.job	0f2c448822659513e8d22d0e6b2bab9d018bffe9f668284b08132d9adb8e3f15.exe

C:\Users\Admin\AppData\Local\Temp\0f2c448822659513e8d22d0e6b2bab9d018bffe9f668284b08132d9adb8e3f15.exe
"C:\Users\Admin\AppData\Local\Temp\0f2c448822659513e8d22d0e6b2bab9d018bffe9f668284b08132d9adb8e3f15.exe"
1⤵
- Drops file in Windows directory
PID:1724

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1724-54-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download
memory/1724-55-0x0000000000390000-0x00000000003BF000-memory.dmp

Filesize
188KB

Download