703e402372e9884cc64d5781eab313270f5d5ff0be24d684f5fc1eada481e590

Analysis

max time kernel
37s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
31-10-2022 00:34

Target

703e402372e9884cc64d5781eab313270f5d5ff0be24d684f5fc1eada481e590.exe
Size

246KB
MD5

a0f7063d2928cb33e2804606cf56d529
SHA1

ae11ae1de36c65de033682bb7d0db76245634f51
SHA256

703e402372e9884cc64d5781eab313270f5d5ff0be24d684f5fc1eada481e590
SHA512

52fbc3837ae36989bc3087909bdfe9bcb76260681a704dbc9d654664c8ae5a7272a02c4b962ce8f91e231a5a6dd45b83cb9a6450eef4310dd3890a3bec129475
SSDEEP

6144:yJBOwcP3booJlVJfYZdXzuyhH7+0fSbtoyC:yJAwMbBJfYZdXtH7+1ZoyC

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\AutoCure.job	703e402372e9884cc64d5781eab313270f5d5ff0be24d684f5fc1eada481e590.exe

C:\Users\Admin\AppData\Local\Temp\703e402372e9884cc64d5781eab313270f5d5ff0be24d684f5fc1eada481e590.exe
"C:\Users\Admin\AppData\Local\Temp\703e402372e9884cc64d5781eab313270f5d5ff0be24d684f5fc1eada481e590.exe"
1⤵
- Drops file in Windows directory
PID:2020

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2020-54-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/2020-55-0x0000000000250000-0x000000000027F000-memory.dmp

Filesize
188KB

Download