44afa7ef940aa0c62fa0142dd19c0803fc494b6be3a0b9f741283a798423850e

Analysis

max time kernel
145s
max time network
151s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
31/10/2022, 00:37

Target

44afa7ef940aa0c62fa0142dd19c0803fc494b6be3a0b9f741283a798423850e.exe
Size

296KB
MD5

82e18909eb52bec9cf7d6aff12f167ed
SHA1

96bb07b669284e08dba3301513393441352d5e54
SHA256

44afa7ef940aa0c62fa0142dd19c0803fc494b6be3a0b9f741283a798423850e
SHA512

e8918dd88f33e393bb7e1b237e55bd04482392c8a2633937960278a292c708e8dee234eabbbcf6d3292622a46d544102220cb1b3fff7afdb864d45bb5bb7b393
SSDEEP

6144:QrtZ0rfYXlYn7ZAK/RZaqKg0tBGA3dG2PHnNIhvUm:2tZ0TxWK/X4tFlPHnNBm

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\EnergySaver.job	44afa7ef940aa0c62fa0142dd19c0803fc494b6be3a0b9f741283a798423850e.exe

C:\Users\Admin\AppData\Local\Temp\44afa7ef940aa0c62fa0142dd19c0803fc494b6be3a0b9f741283a798423850e.exe
"C:\Users\Admin\AppData\Local\Temp\44afa7ef940aa0c62fa0142dd19c0803fc494b6be3a0b9f741283a798423850e.exe"
1⤵
- Drops file in Windows directory
PID:1736

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1736-54-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/1736-55-0x00000000002A0000-0x00000000002CF000-memory.dmp

Filesize
188KB

Download
memory/1736-59-0x0000000000160000-0x0000000000192000-memory.dmp

Filesize
200KB

Download