151801ab91c7fa5c19fad400077eb7e4b235382814b3e181692fb5df46a6a8d2

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 13:42

Target

151801ab91c7fa5c19fad400077eb7e4b235382814b3e181692fb5df46a6a8d2.exe
Size

261KB
MD5

415246981baac994f6ce460542eba16c
SHA1

207345c60db31c54bd956af435449586b829efe8
SHA256

151801ab91c7fa5c19fad400077eb7e4b235382814b3e181692fb5df46a6a8d2
SHA512

ab00d928629934ceae4a27fc062b2664a3c73c7c3f1e047743117c31c0e468f77f9c9b491a4f142a9c5865499b1c3223d2938af9f64c6e5b4841cb2103e7e6a3
SSDEEP

3072:m6WeXjyXHfB7BT218jeO3WB5+F0OdDqOyyyXbO6E2Q1PoR7bVzNeeFqnqeKqxJIE:mHezyXUOmBU61OyycxELKpUwqnq6JIE

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\OpenSlides.job	151801ab91c7fa5c19fad400077eb7e4b235382814b3e181692fb5df46a6a8d2.exe

C:\Users\Admin\AppData\Local\Temp\151801ab91c7fa5c19fad400077eb7e4b235382814b3e181692fb5df46a6a8d2.exe
"C:\Users\Admin\AppData\Local\Temp\151801ab91c7fa5c19fad400077eb7e4b235382814b3e181692fb5df46a6a8d2.exe"
1⤵
- Drops file in Windows directory
PID:1380

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1380-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/1380-55-0x00000000001B0000-0x00000000001DF000-memory.dmp

Filesize
188KB

Download
memory/1380-59-0x00000000001E0000-0x0000000000207000-memory.dmp

Filesize
156KB

Download