5b24f24fc2bc4ec175a0e643279f2020818333842c72017f19435f9736ec66ae

Analysis

max time kernel
28s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 12:51

Target

5b24f24fc2bc4ec175a0e643279f2020818333842c72017f19435f9736ec66ae.exe
Size

286KB
MD5

4fe91a2c6583f64667fce547c4bf46f7
SHA1

04bc4849e85eee9b3ae34c39c7683b666f19d2b5
SHA256

5b24f24fc2bc4ec175a0e643279f2020818333842c72017f19435f9736ec66ae
SHA512

01ba2ea9782a30e01f8ff14a08d82a901c2bfaf1e03abf8b5df193520e60fff8c91f581c372a909fa96ee0a74b5c48d892d9fc97ac0ea9bb626abbbb229fcec9
SSDEEP

3072:uemaTXdHet0kTa3Iy3haaTWMeF4qHxI/cyS7jAfLOq1oUidJHS+LDlJy9GiTS:ph5HeI3j3YSeF1RuNv47dlkQiTS

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\PhoneBites.job	5b24f24fc2bc4ec175a0e643279f2020818333842c72017f19435f9736ec66ae.exe

C:\Users\Admin\AppData\Local\Temp\5b24f24fc2bc4ec175a0e643279f2020818333842c72017f19435f9736ec66ae.exe
"C:\Users\Admin\AppData\Local\Temp\5b24f24fc2bc4ec175a0e643279f2020818333842c72017f19435f9736ec66ae.exe"
1⤵
- Drops file in Windows directory
PID:1072

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1072-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/1072-55-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/1072-59-0x0000000000911000-0x0000000000932000-memory.dmp

Filesize
132KB

Download
memory/1072-60-0x0000000000911000-0x0000000000932000-memory.dmp

Filesize
132KB

Download