b4d64d75a95cc53276fe483971b019c6b3d1e6234a253b4bd984c81270a38844

Analysis

max time kernel
87s
max time network
102s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 12:07

Target

b4d64d75a95cc53276fe483971b019c6b3d1e6234a253b4bd984c81270a38844.exe
Size

1.3MB
MD5

c1973b2b4eee2d9aeb113fdd57914f99
SHA1

35cc58cdf85c25b7039a94acde46862bb1ee1756
SHA256

b4d64d75a95cc53276fe483971b019c6b3d1e6234a253b4bd984c81270a38844
SHA512

f58412e3dcf843ce289e02f4c9f7d4b3bd0865e621901d7d9b254d616a203a5d4df2061e08602a97a8fe866e0d83738859d9cd84bd013221ae170ee6d817f842
SSDEEP

6144:3XhsUJX5igf1GhBKZrT56czzrB5NG4+CPzLv9k985x:npf4BKZrFzvB5UCP39k+5x

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Bidaily Synchronize Task[973b].job	b4d64d75a95cc53276fe483971b019c6b3d1e6234a253b4bd984c81270a38844.exe

C:\Users\Admin\AppData\Local\Temp\b4d64d75a95cc53276fe483971b019c6b3d1e6234a253b4bd984c81270a38844.exe
"C:\Users\Admin\AppData\Local\Temp\b4d64d75a95cc53276fe483971b019c6b3d1e6234a253b4bd984c81270a38844.exe"
1⤵
- Drops file in Windows directory
PID:1416

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1416-54-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/1416-55-0x00000000001D0000-0x00000000001FF000-memory.dmp

Filesize
188KB

Download