906388fd307b90e6129569090a9ebc103f7f72c2210618489ad562c2f476662b

Analysis

max time kernel
1s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 00:23

Target

906388fd307b90e6129569090a9ebc103f7f72c2210618489ad562c2f476662b.exe
Size

296KB
MD5

0dd7e2f89f6a9e74b8f5701ba8ac7bb0
SHA1

e367cedb74bbac3e073eaf04604a19071e4a828a
SHA256

906388fd307b90e6129569090a9ebc103f7f72c2210618489ad562c2f476662b
SHA512

07fdc63e26eff61c1518e4e36eafb032867432008d638dfec2715c4fddf0cb17f464173ba2c21091e7b77208e4164ab5c3b8b10dd1d0fc63f3f66c0a70bf010c
SSDEEP

6144:WRc3Noi1fjRHdRw+1+RLw1JFquxoqs6S+t:EcBfbaRLtuxPM+t

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\SmartArrange.job	906388fd307b90e6129569090a9ebc103f7f72c2210618489ad562c2f476662b.exe

C:\Users\Admin\AppData\Local\Temp\906388fd307b90e6129569090a9ebc103f7f72c2210618489ad562c2f476662b.exe
"C:\Users\Admin\AppData\Local\Temp\906388fd307b90e6129569090a9ebc103f7f72c2210618489ad562c2f476662b.exe"
1⤵
- Drops file in Windows directory
PID:1884

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1884-54-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download
memory/1884-55-0x00000000000F0000-0x000000000011F000-memory.dmp

Filesize
188KB

Download
memory/1884-59-0x00000000013A1000-0x00000000013C2000-memory.dmp

Filesize
132KB

Download