b740fd04b5dfff6c225cf1fafc547910fad52eb2e9b3a0d845c73d2a653759b1

Analysis

max time kernel
153s
max time network
166s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 03:48

Target

b740fd04b5dfff6c225cf1fafc547910fad52eb2e9b3a0d845c73d2a653759b1.exe
Size

307KB
MD5

92ab6500f8ffa3773c0e593433bc9afb
SHA1

c258214dd73eff48151d2200e83461a007effbfc
SHA256

b740fd04b5dfff6c225cf1fafc547910fad52eb2e9b3a0d845c73d2a653759b1
SHA512

59e3d1bb248fe3a50790092394d34790d76b64fcb459c0939d4c62dd2293727ac6965dc14d75f89f4f80124cc4f4e45ed12b268a3eac2ddd6844113ddd7aef88
SSDEEP

6144:gWb8Onz17iy0zBYZS+eZlYUhrYiitTx9CIW0NiVWL:tb8OxsBtyUhrSFUIWwioL

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\TravelOrganizer.job	b740fd04b5dfff6c225cf1fafc547910fad52eb2e9b3a0d845c73d2a653759b1.exe

C:\Users\Admin\AppData\Local\Temp\b740fd04b5dfff6c225cf1fafc547910fad52eb2e9b3a0d845c73d2a653759b1.exe
"C:\Users\Admin\AppData\Local\Temp\b740fd04b5dfff6c225cf1fafc547910fad52eb2e9b3a0d845c73d2a653759b1.exe"
1⤵
- Drops file in Windows directory
PID:1112

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1112-54-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download
memory/1112-55-0x0000000000220000-0x000000000024F000-memory.dmp

Filesize
188KB

Download