bc9163e4f21f1acc355e4db12fb7f9633c2379290014c7ab80e0375c39c98bd3

Analysis

max time kernel
37s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 06:55

Target

bc9163e4f21f1acc355e4db12fb7f9633c2379290014c7ab80e0375c39c98bd3.exe
Size

299KB
MD5

e379ccc0d677c7094e4e6be0398aaac5
SHA1

e04f0ab473f9ceb2f19ba7591b7713219fdb56d8
SHA256

bc9163e4f21f1acc355e4db12fb7f9633c2379290014c7ab80e0375c39c98bd3
SHA512

94a5ce7570f6995c6b9d898e3ba66580e3ac905dbd15850925a90b4e96548f983051106373f39b8a13e53e4c32f0f319ebdf32595027ac8155ab8c0e0e0ebbfe
SSDEEP

6144:7bCMKjsq0UsAckwmmUaK9qU8L8wHAvI3zwO1ErJzH:7bCNeXkPRaK4L1gvwzR1AzH

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\IronKeep.job	bc9163e4f21f1acc355e4db12fb7f9633c2379290014c7ab80e0375c39c98bd3.exe

C:\Users\Admin\AppData\Local\Temp\bc9163e4f21f1acc355e4db12fb7f9633c2379290014c7ab80e0375c39c98bd3.exe
"C:\Users\Admin\AppData\Local\Temp\bc9163e4f21f1acc355e4db12fb7f9633c2379290014c7ab80e0375c39c98bd3.exe"
1⤵
- Drops file in Windows directory
PID:1248

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1248-54-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download
memory/1248-55-0x00000000000C0000-0x00000000000EF000-memory.dmp

Filesize
188KB

Download