676abf35d050db974415c16a81b3f1cbc606f0bfd9883cfcc0dd4c86bd208894

Analysis

max time kernel
39s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 13:10

Target

676abf35d050db974415c16a81b3f1cbc606f0bfd9883cfcc0dd4c86bd208894.exe
Size

286KB
MD5

368724906c302d24bc5bd6072ea028fc
SHA1

2454752778be62a1b1f90084fc4e222758853e60
SHA256

676abf35d050db974415c16a81b3f1cbc606f0bfd9883cfcc0dd4c86bd208894
SHA512

0317f0d031e29ddd233f1c4ceac08fc9f254fc8f1a39bf3e79c8d13debbe8f952b3dc98fdac2094624c98fe465e6a9390cd894c2b87e4fec9414d3cf6c85c080
SSDEEP

3072:eemaTXdHet0kTa3Iy3haaTWMeF4qHxI/cyS7j+ex0jdwAMVlnh4YnBSeNLCJzaQH:Zh5HeI3j3YSeF1RuN/dwbhXnF/Qj13T9

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\SunRun.job	676abf35d050db974415c16a81b3f1cbc606f0bfd9883cfcc0dd4c86bd208894.exe

C:\Users\Admin\AppData\Local\Temp\676abf35d050db974415c16a81b3f1cbc606f0bfd9883cfcc0dd4c86bd208894.exe
"C:\Users\Admin\AppData\Local\Temp\676abf35d050db974415c16a81b3f1cbc606f0bfd9883cfcc0dd4c86bd208894.exe"
1⤵
- Drops file in Windows directory
PID:816

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/816-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/816-55-0x00000000001B0000-0x00000000001DF000-memory.dmp

Filesize
188KB

Download
memory/816-59-0x0000000000170000-0x00000000001B0000-memory.dmp

Filesize
256KB

Download