40917c30d4f0e0162f817e53f0144029bd3df56759a401027e383a91d227197b

Analysis

max time kernel
66s
max time network
70s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 03:56

Target

40917c30d4f0e0162f817e53f0144029bd3df56759a401027e383a91d227197b.exe
Size

337KB
MD5

83c0bba251c57a83fb2ad4ce018de8ff
SHA1

38f75c2ceddc1688567275af775f17104ed7a33c
SHA256

40917c30d4f0e0162f817e53f0144029bd3df56759a401027e383a91d227197b
SHA512

b1e623db2a34c191b113e53821fac3848f3bdc3d9d36e6e3139fb31f452d63ce70c328d1d1c345d73d2e00e08a0a01df7c4d077a3e2be9f832e01f66d2ae8161
SSDEEP

6144:KemCuhHfF9HXuIPBZyK2Rctue4vHmKJ6wrvC:2CAH8pRctuVHtYwrvC

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\TouchReader.job	40917c30d4f0e0162f817e53f0144029bd3df56759a401027e383a91d227197b.exe

C:\Users\Admin\AppData\Local\Temp\40917c30d4f0e0162f817e53f0144029bd3df56759a401027e383a91d227197b.exe
"C:\Users\Admin\AppData\Local\Temp\40917c30d4f0e0162f817e53f0144029bd3df56759a401027e383a91d227197b.exe"
1⤵
- Drops file in Windows directory
PID:1972

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1972-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/1972-55-0x0000000000360000-0x000000000038F000-memory.dmp

Filesize
188KB

Download