32b8fe222d48c36a5d5c90eaccd4efbbc005b2b49b9f3dd56950c9f64a5cc2b7

Analysis

max time kernel
36s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 13:52

Target

32b8fe222d48c36a5d5c90eaccd4efbbc005b2b49b9f3dd56950c9f64a5cc2b7.exe
Size

286KB
MD5

190b967e40718e586ab5849a5788e752
SHA1

6fb97edc99e560556c77b33b1ef1b4f6994fdb5f
SHA256

32b8fe222d48c36a5d5c90eaccd4efbbc005b2b49b9f3dd56950c9f64a5cc2b7
SHA512

78b8ba2d9d773dda27b108c8fd410efd111bfc968dcfba320c1dac4c6a5fee0e9bac204fa6829c6aec59c4ba1f96293fba2c62265399b357b6eb71b6f01f1b44
SSDEEP

6144:HdJW03qFSlVF47FCYdqzysGZuOBHIXsc35HdSf:HDW03qKO7rdiysGZTsP35HdSf

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\DreamJournal.job	32b8fe222d48c36a5d5c90eaccd4efbbc005b2b49b9f3dd56950c9f64a5cc2b7.exe

C:\Users\Admin\AppData\Local\Temp\32b8fe222d48c36a5d5c90eaccd4efbbc005b2b49b9f3dd56950c9f64a5cc2b7.exe
"C:\Users\Admin\AppData\Local\Temp\32b8fe222d48c36a5d5c90eaccd4efbbc005b2b49b9f3dd56950c9f64a5cc2b7.exe"
1⤵
- Drops file in Windows directory
PID:1612

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1612-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1612-55-0x0000000001371000-0x0000000001392000-memory.dmp

Filesize
132KB

Download
memory/1612-56-0x00000000000F0000-0x000000000011F000-memory.dmp

Filesize
188KB

Download
memory/1612-60-0x0000000001371000-0x0000000001392000-memory.dmp

Filesize
132KB

Download