941efa8c383e1bb066cf024e32df698ed5562b503c28b15f0a220d2bd4da8274

Analysis

max time kernel
35s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 14:39

Target

941efa8c383e1bb066cf024e32df698ed5562b503c28b15f0a220d2bd4da8274.exe
Size

286KB
MD5

5d0bde414397a1debdeceb0f3e4d58b0
SHA1

d39aa062a097b68e9717a19c46fc281f6865c0e3
SHA256

941efa8c383e1bb066cf024e32df698ed5562b503c28b15f0a220d2bd4da8274
SHA512

8cc243a296dd195c186e8d0c5c330fbd991faf4cd7bd79796073b1d63e91b5e2ae47bae9855a36416488f9fc21c31846cf4c615b151f6997ea9d799e9ba52f79
SSDEEP

6144:8dJW03qFSlVF47FCYdqzysGZuTFA1sO/+S:8DW03qKO7rdiysGZQFA6O/+S

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\SaveXtreme.job	941efa8c383e1bb066cf024e32df698ed5562b503c28b15f0a220d2bd4da8274.exe

C:\Users\Admin\AppData\Local\Temp\941efa8c383e1bb066cf024e32df698ed5562b503c28b15f0a220d2bd4da8274.exe
"C:\Users\Admin\AppData\Local\Temp\941efa8c383e1bb066cf024e32df698ed5562b503c28b15f0a220d2bd4da8274.exe"
1⤵
- Drops file in Windows directory
PID:1928

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1928-54-0x00000000015B1000-0x00000000015D2000-memory.dmp

Filesize
132KB

Download
memory/1928-55-0x00000000762B1000-0x00000000762B3000-memory.dmp

Filesize
8KB

Download
memory/1928-56-0x00000000000F0000-0x000000000011F000-memory.dmp

Filesize
188KB

Download
memory/1928-60-0x00000000015B1000-0x00000000015D2000-memory.dmp

Filesize
132KB

Download