5a1040c037ef6da6dfab923a2a8fb8bd6559108ffb94ae5566d24e1a12bcf308

Analysis

max time kernel
9s
max time network
87s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 08:39

Target

5a1040c037ef6da6dfab923a2a8fb8bd6559108ffb94ae5566d24e1a12bcf308.exe
Size

317KB
MD5

a51fcfeb6084b6283acef0df3f89b842
SHA1

bed9cad979041571cedc2dd27f0c4a22c4b8dcbc
SHA256

5a1040c037ef6da6dfab923a2a8fb8bd6559108ffb94ae5566d24e1a12bcf308
SHA512

42a4dac42dc4b4cd28ca23885f5e58e8d69746a92b45c23d77901fc012c0ff06be1623b29bfe7463380f71a1c1c69e52ed7c52e9451438f52d293617c20ace17
SSDEEP

6144:PZ7TPijYgpI778yBgmTGIAjY76j1d3Dm+9NdK:PdPXgpI7IMhGIAjSSdzxNdK

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\NumberPro.job	5a1040c037ef6da6dfab923a2a8fb8bd6559108ffb94ae5566d24e1a12bcf308.exe

C:\Users\Admin\AppData\Local\Temp\5a1040c037ef6da6dfab923a2a8fb8bd6559108ffb94ae5566d24e1a12bcf308.exe
"C:\Users\Admin\AppData\Local\Temp\5a1040c037ef6da6dfab923a2a8fb8bd6559108ffb94ae5566d24e1a12bcf308.exe"
1⤵
- Drops file in Windows directory
PID:1368

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1368-54-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download
memory/1368-55-0x0000000000150000-0x000000000017F000-memory.dmp

Filesize
188KB

Download