19ae1a1227e66eafdc70c7498146281d1928a7c21179814a5b7f7a92e161276e

Analysis

max time kernel
38s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 15:03

Target

19ae1a1227e66eafdc70c7498146281d1928a7c21179814a5b7f7a92e161276e.exe
Size

286KB
MD5

9189b8122d35ff98cbefc6baf15c726b
SHA1

b9031eb39358c4ac1028a0a744ef353e1361470f
SHA256

19ae1a1227e66eafdc70c7498146281d1928a7c21179814a5b7f7a92e161276e
SHA512

c3e77c481806f010d8d48a4009f78e8bfc9d1b033bb733ec66e61d429c2669d55cbafb95d6ce51e3869e29f95921192ab44641ba001496b3d6cfd50d227cdbcb
SSDEEP

6144:Bh5HeI3j3YSeF1RuNVG+V8x7J+zQVgaLKiTj:Bh5T3j3vS1EN7Vat05iTj

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\ExpertCook.job	19ae1a1227e66eafdc70c7498146281d1928a7c21179814a5b7f7a92e161276e.exe

C:\Users\Admin\AppData\Local\Temp\19ae1a1227e66eafdc70c7498146281d1928a7c21179814a5b7f7a92e161276e.exe
"C:\Users\Admin\AppData\Local\Temp\19ae1a1227e66eafdc70c7498146281d1928a7c21179814a5b7f7a92e161276e.exe"
1⤵
- Drops file in Windows directory
PID:1884

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1884-54-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/1884-55-0x0000000000160000-0x000000000018F000-memory.dmp

Filesize
188KB

Download
memory/1884-59-0x00000000014E1000-0x0000000001502000-memory.dmp

Filesize
132KB

Download