c40c06625f678de03d5ec289cb5982dc4720cdffbb17a2d41b8483166ec6ba00

Analysis

max time kernel
1s
max time network
40s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 08:14

Target

c40c06625f678de03d5ec289cb5982dc4720cdffbb17a2d41b8483166ec6ba00.exe
Size

318KB
MD5

fa4d424e9298a3f67d4627d30bcb2acd
SHA1

a8809426b736d9ae2e69c32c3c017617bf4495f3
SHA256

c40c06625f678de03d5ec289cb5982dc4720cdffbb17a2d41b8483166ec6ba00
SHA512

70d54284f8f34bce4aeab563132538ab7091db71f8aecd2d18c72213514570aad0b69e0e563cbb2714fd4460057e3d566d510b8678b9ce1c90a4140080b69f51
SSDEEP

6144:5CN+oLhEBTmcgtJTFLpFeOG2bObQ4Bj8qHI04pEQ/:doLkmcoVFVFeOG2SQ4Bj8P04pEQ/

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\MotionFix.job	c40c06625f678de03d5ec289cb5982dc4720cdffbb17a2d41b8483166ec6ba00.exe

C:\Users\Admin\AppData\Local\Temp\c40c06625f678de03d5ec289cb5982dc4720cdffbb17a2d41b8483166ec6ba00.exe
"C:\Users\Admin\AppData\Local\Temp\c40c06625f678de03d5ec289cb5982dc4720cdffbb17a2d41b8483166ec6ba00.exe"
1⤵
- Drops file in Windows directory
PID:1756

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1756-54-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download
memory/1756-55-0x0000000000780000-0x00000000007AF000-memory.dmp

Filesize
188KB

Download