f385738aa9eda546252394cbee84edf35f8bd290e604a046cc32dbc81e24ef7b

Analysis

max time kernel
35s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 15:25

Target

f385738aa9eda546252394cbee84edf35f8bd290e604a046cc32dbc81e24ef7b.exe
Size

285KB
MD5

7bf3f7f247da47065981296528dd8ef8
SHA1

01c865ffd87103b76862dce94376fe66eaffe1b9
SHA256

f385738aa9eda546252394cbee84edf35f8bd290e604a046cc32dbc81e24ef7b
SHA512

66280d5cdb6afd650c36a83d452efa086d730219d9afdc0b598232865d7a8d70ab6d3d23d667fcbfc32cf89cea2f71872bc8a87a7dd5d83a33debcbf018585d5
SSDEEP

3072:ALYmRDCmYzDblNQMu9eOc2Jy5Ra9tVqe/k9LclEUcjqLE7RHxBZ5dbWNnKvX69Xq:2w/TaE2Jy5oEe/kpcWZf9VoKvYXznv2

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\StyleChat.job	f385738aa9eda546252394cbee84edf35f8bd290e604a046cc32dbc81e24ef7b.exe

C:\Users\Admin\AppData\Local\Temp\f385738aa9eda546252394cbee84edf35f8bd290e604a046cc32dbc81e24ef7b.exe
"C:\Users\Admin\AppData\Local\Temp\f385738aa9eda546252394cbee84edf35f8bd290e604a046cc32dbc81e24ef7b.exe"
1⤵
- Drops file in Windows directory
PID:580

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/580-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/580-55-0x0000000000140000-0x000000000016F000-memory.dmp

Filesize
188KB

Download
memory/580-59-0x00000000001F1000-0x0000000000212000-memory.dmp

Filesize
132KB

Download