c19edbf3182b808ee71a0f743f07fdca09b373af83a09eb48746898e5cbc3d1f

Analysis

max time kernel
96s
max time network
107s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 04:03

Target

c19edbf3182b808ee71a0f743f07fdca09b373af83a09eb48746898e5cbc3d1f.exe
Size

246KB
MD5

840d0ca48517003290ce59acf3028b77
SHA1

5ba10c768d8e51f9b2178f17b82027fefce84f63
SHA256

c19edbf3182b808ee71a0f743f07fdca09b373af83a09eb48746898e5cbc3d1f
SHA512

7d36ce2b488a1e63295afd1bcc71a59d067b03398872d6ae0a6ce8d75d3d8423b178cd263021c235e81e7bb2cf86c7d770e26ac216384dfd9fe0b4f47740f205
SSDEEP

6144:OuKzYED2sSaNQy7jxTr6bI+wXFItQX5YydqC2g7:OuMYEqsftWbcXvKyMg7

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\BookKeep.job	c19edbf3182b808ee71a0f743f07fdca09b373af83a09eb48746898e5cbc3d1f.exe

C:\Users\Admin\AppData\Local\Temp\c19edbf3182b808ee71a0f743f07fdca09b373af83a09eb48746898e5cbc3d1f.exe
"C:\Users\Admin\AppData\Local\Temp\c19edbf3182b808ee71a0f743f07fdca09b373af83a09eb48746898e5cbc3d1f.exe"
1⤵
- Drops file in Windows directory
PID:1324

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1324-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/1324-55-0x0000000000290000-0x00000000002BF000-memory.dmp

Filesize
188KB

Download