4845eb6cde9d8fee03f25b7a78785eed8bfd1906f855fe3c499d6e1394e0ae19

Analysis

max time kernel
84s
max time network
107s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
31/10/2022, 00:49

Target

4845eb6cde9d8fee03f25b7a78785eed8bfd1906f855fe3c499d6e1394e0ae19.exe
Size

336KB
MD5

915bd5134c432b296bbe1df155a5bbc4
SHA1

87aa6256ae68981792fb4fe9696638fc9f8db90f
SHA256

4845eb6cde9d8fee03f25b7a78785eed8bfd1906f855fe3c499d6e1394e0ae19
SHA512

525f26a17dfcc2a5e65a68cf909bdbdf1f64eab99198cc5ac7feb41c9af383fca9e02e39d0d6f1c0bae6bcc979cd6292d1cc53f2341093cc94108a1a8855104b
SSDEEP

6144:nsPH1Uc06y/ORPdhUD5kEBcqkMFsP+bkqsBVF2q:nsPVUnykD+Ycq7FsEcUq

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\ExpertCare.job	4845eb6cde9d8fee03f25b7a78785eed8bfd1906f855fe3c499d6e1394e0ae19.exe

C:\Users\Admin\AppData\Local\Temp\4845eb6cde9d8fee03f25b7a78785eed8bfd1906f855fe3c499d6e1394e0ae19.exe
"C:\Users\Admin\AppData\Local\Temp\4845eb6cde9d8fee03f25b7a78785eed8bfd1906f855fe3c499d6e1394e0ae19.exe"
1⤵
- Drops file in Windows directory
PID:1836

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1836-54-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download
memory/1836-55-0x00000000003A0000-0x00000000003CF000-memory.dmp

Filesize
188KB

Download