6a5891e104fcc362a8e01d7a8e844e9752ca13755d3d298fe04f40f2dbb63e5b

Analysis

max time kernel
48s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30-10-2022 04:11

Target

6a5891e104fcc362a8e01d7a8e844e9752ca13755d3d298fe04f40f2dbb63e5b.exe
Size

188KB
MD5

54c74ec4f7b1eae31605d1cdecb588a0
SHA1

a3cdbdef4ca6208258a79531a76b49460ea88782
SHA256

6a5891e104fcc362a8e01d7a8e844e9752ca13755d3d298fe04f40f2dbb63e5b
SHA512

00c76a2d30d4236ea648ab3ef8b141afbb407396efea75d3920f2c3068a39bbd820b314dd2be551bc2d9aa6d7085e8f99a39ca95a9db7b9b47e6a95250349698
SSDEEP

3072:aGtw2YToZ3bMpQWbuqRjs4y5IBLEIuDvnqs/b2C:aG62YTWMv2pIkH2C

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\FunTunes.job	6a5891e104fcc362a8e01d7a8e844e9752ca13755d3d298fe04f40f2dbb63e5b.exe

C:\Users\Admin\AppData\Local\Temp\6a5891e104fcc362a8e01d7a8e844e9752ca13755d3d298fe04f40f2dbb63e5b.exe
"C:\Users\Admin\AppData\Local\Temp\6a5891e104fcc362a8e01d7a8e844e9752ca13755d3d298fe04f40f2dbb63e5b.exe"
1⤵
- Drops file in Windows directory
PID:1268

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1268-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/1268-55-0x00000000000E0000-0x000000000010F000-memory.dmp

Filesize
188KB

Download
memory/1268-59-0x0000000000020000-0x0000000000040000-memory.dmp

Filesize
128KB

Download
memory/1268-60-0x0000000000020000-0x0000000000040000-memory.dmp

Filesize
128KB

Download