4600c3e8a018c5babb6a420dcf576b4e5f71a73d3946c891aa5595f920fe4ec2

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 03:55

Target

4600c3e8a018c5babb6a420dcf576b4e5f71a73d3946c891aa5595f920fe4ec2.exe
Size

345KB
MD5

92e3a967131fb05d58882ef33924eb3a
SHA1

f2d5f2da314cf99667e64de2a675e4fd223182f0
SHA256

4600c3e8a018c5babb6a420dcf576b4e5f71a73d3946c891aa5595f920fe4ec2
SHA512

62440baec7e7b10c2675a89e7efc6c6e5234bd748fb47457ecb45a26ad1b2d563b197a75a58d1bbaca9423610addeeffb4dcf251e9d608f262e59ee8449d26d9
SSDEEP

6144:215kHv1GLJDpTKc2/EDlS5kghtGMhZm366GOQo4BoMvsRPldnV:m5kHsJ/VD0mgjZm3vsBoMURdNV

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\RestoGuide.job	4600c3e8a018c5babb6a420dcf576b4e5f71a73d3946c891aa5595f920fe4ec2.exe

C:\Users\Admin\AppData\Local\Temp\4600c3e8a018c5babb6a420dcf576b4e5f71a73d3946c891aa5595f920fe4ec2.exe
"C:\Users\Admin\AppData\Local\Temp\4600c3e8a018c5babb6a420dcf576b4e5f71a73d3946c891aa5595f920fe4ec2.exe"
1⤵
- Drops file in Windows directory
PID:1944

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1944-54-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1944-55-0x0000000000390000-0x00000000003BF000-memory.dmp

Filesize
188KB

Download