f5c48a7e5def2033d721ef0692e686b194b42c8ba71350eece459bf5c53c287d

Analysis

max time kernel
69s
max time network
75s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 04:02

Target

f5c48a7e5def2033d721ef0692e686b194b42c8ba71350eece459bf5c53c287d.exe
Size

295KB
MD5

925fb237fe1ccbd7f6854f1f8a18f3c2
SHA1

42e339f949b0955d1f8a06108d5fb26c11093342
SHA256

f5c48a7e5def2033d721ef0692e686b194b42c8ba71350eece459bf5c53c287d
SHA512

fb125e102244888cb5fbae7358d3c9588d6e2152b473fbc88843896c299b53b5913b9049c3508d7ecb44676d8a29fde677cd3d0e0c81ac4ccd5c1369f504adfa
SSDEEP

6144:xbCMThjsq0UsAckwmmUaK9qU8L363mlZrfyT7kfjkM+B8:xbCKeXkPRaK4L3Vpf7fO8

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\LifeCare.job	f5c48a7e5def2033d721ef0692e686b194b42c8ba71350eece459bf5c53c287d.exe

C:\Users\Admin\AppData\Local\Temp\f5c48a7e5def2033d721ef0692e686b194b42c8ba71350eece459bf5c53c287d.exe
"C:\Users\Admin\AppData\Local\Temp\f5c48a7e5def2033d721ef0692e686b194b42c8ba71350eece459bf5c53c287d.exe"
1⤵
- Drops file in Windows directory
PID:1788

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1788-54-0x0000000075241000-0x0000000075243000-memory.dmp

Filesize
8KB

Download
memory/1788-55-0x0000000000360000-0x000000000038F000-memory.dmp

Filesize
188KB

Download