5cc79577f19077b945926d49504a8973a1a2fd1b6acaa7982e6ff85a9a434ac0

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 13:23

Target

5cc79577f19077b945926d49504a8973a1a2fd1b6acaa7982e6ff85a9a434ac0.exe
Size

286KB
MD5

30d1423ba7d44edf059e3185a5b40394
SHA1

1e83ff16ebf9dde6cba0ed5c325306f2ec09ca9f
SHA256

5cc79577f19077b945926d49504a8973a1a2fd1b6acaa7982e6ff85a9a434ac0
SHA512

27708c70162034af237076779257294838d9babe014ae9e00e3e84103e2f8d936df11d31eeaa07cbd89d7a50afca5f45b6ab1e4b1b9e88bd6969cc234eccd32c
SSDEEP

6144:pdJW03qFSlVF47FCYdqzysGZuJ637/DT11R3HrQir:pDW03qKO7rdiysGZrr/ZUir

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\EfficientNotes.job	5cc79577f19077b945926d49504a8973a1a2fd1b6acaa7982e6ff85a9a434ac0.exe

C:\Users\Admin\AppData\Local\Temp\5cc79577f19077b945926d49504a8973a1a2fd1b6acaa7982e6ff85a9a434ac0.exe
"C:\Users\Admin\AppData\Local\Temp\5cc79577f19077b945926d49504a8973a1a2fd1b6acaa7982e6ff85a9a434ac0.exe"
1⤵
- Drops file in Windows directory
PID:1416

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1416-54-0x0000000075E81000-0x0000000075E83000-memory.dmp

Filesize
8KB

Download
memory/1416-55-0x0000000000671000-0x0000000000692000-memory.dmp

Filesize
132KB

Download
memory/1416-56-0x0000000000130000-0x000000000015F000-memory.dmp

Filesize
188KB

Download
memory/1416-60-0x0000000000671000-0x0000000000692000-memory.dmp

Filesize
132KB

Download