4a3237cb0dfc3cdf3f6c51e7a8357fd35d6a267c2bc8494bb3adb19d2c06f021

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 13:52

Target

4a3237cb0dfc3cdf3f6c51e7a8357fd35d6a267c2bc8494bb3adb19d2c06f021.exe
Size

324KB
MD5

6eca02f9e8ae138c77d96a6e7d050f84
SHA1

9260a7f516cb47854d32442cf9d5a3a4864253af
SHA256

4a3237cb0dfc3cdf3f6c51e7a8357fd35d6a267c2bc8494bb3adb19d2c06f021
SHA512

3e5c314dd6bd2063344d165fd334047d96b07a9286ccaf2d6d1d80c6e603269ce1816233e6dafb8b0028774052113d4efc9df28796f674eda1964eaf0f954450
SSDEEP

6144:eJDLTUYN+JuqAypwfc8QTVB4FJOspEihPdkxJfHY:eJDLTUW+Juq9ph8QiJOspEmdYJf4

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\PhotoHop.job	4a3237cb0dfc3cdf3f6c51e7a8357fd35d6a267c2bc8494bb3adb19d2c06f021.exe

C:\Users\Admin\AppData\Local\Temp\4a3237cb0dfc3cdf3f6c51e7a8357fd35d6a267c2bc8494bb3adb19d2c06f021.exe
"C:\Users\Admin\AppData\Local\Temp\4a3237cb0dfc3cdf3f6c51e7a8357fd35d6a267c2bc8494bb3adb19d2c06f021.exe"
1⤵
- Drops file in Windows directory
PID:112

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/112-54-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/112-55-0x00000000001B0000-0x00000000001DF000-memory.dmp

Filesize
188KB

Download
memory/112-59-0x00000000001E0000-0x0000000000207000-memory.dmp

Filesize
156KB

Download
memory/112-63-0x0000000000171000-0x000000000019B000-memory.dmp

Filesize
168KB

Download