70678fc389739a4cc5f791adb7d0e23d7f1e0ae73f473d50c72e92de960d214d

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 14:46

Target

70678fc389739a4cc5f791adb7d0e23d7f1e0ae73f473d50c72e92de960d214d.exe
Size

235KB
MD5

ebf3d6f8c8b8508143b85788cb8f7a92
SHA1

0fa624fd21cfa40d88898c41b2ad3036bfeb5a79
SHA256

70678fc389739a4cc5f791adb7d0e23d7f1e0ae73f473d50c72e92de960d214d
SHA512

839db804624a67e417b585ec609591ad35d92823f26145c8a6ed0320d1b17e74ac491ea468c46b4f342ca56f106a0055b6099fb2cc3d584479aec8b0fbc61edd
SSDEEP

3072:9uctsA1YoPkZgfTujMEan00P75jelxft5speoV/v5w1Lv+i+80GM9PBxuQaEBeiU:9zNJR7nBP75jc0peoxvS273ungeiU

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\AlcoProof.job	70678fc389739a4cc5f791adb7d0e23d7f1e0ae73f473d50c72e92de960d214d.exe

C:\Users\Admin\AppData\Local\Temp\70678fc389739a4cc5f791adb7d0e23d7f1e0ae73f473d50c72e92de960d214d.exe
"C:\Users\Admin\AppData\Local\Temp\70678fc389739a4cc5f791adb7d0e23d7f1e0ae73f473d50c72e92de960d214d.exe"
1⤵
- Drops file in Windows directory
PID:1792

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1792-54-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download
memory/1792-55-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/1792-59-0x00000000010C1000-0x00000000010E2000-memory.dmp

Filesize
132KB

Download