93220f97f655a1fdcbe5c5cd2cfe0b548a2b4a3a81901a372dc82197667d515d

Analysis

max time kernel
31s
max time network
160s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
31-10-2022 01:00

Target

93220f97f655a1fdcbe5c5cd2cfe0b548a2b4a3a81901a372dc82197667d515d.exe
Size

188KB
MD5

a19d990528a733ab7689a687abbb18c0
SHA1

d861e93cd368c0df50fe18b142b654d32336090c
SHA256

93220f97f655a1fdcbe5c5cd2cfe0b548a2b4a3a81901a372dc82197667d515d
SHA512

970a1bb5eca491a86baf3a47f5505d944b0b66c4540804bf5d00b411b99da22b50af45e09d16d82d00b286b107f5f83b840c68649d0158b1f17575aeabcff047
SSDEEP

3072:hamztLI/EqVrLnkhJX+sRdYLDce+9n819DjI2/EqsIb59a4:hxFI8qVkDuAdY31F16gJ

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\PicFire.job	93220f97f655a1fdcbe5c5cd2cfe0b548a2b4a3a81901a372dc82197667d515d.exe

C:\Users\Admin\AppData\Local\Temp\93220f97f655a1fdcbe5c5cd2cfe0b548a2b4a3a81901a372dc82197667d515d.exe
"C:\Users\Admin\AppData\Local\Temp\93220f97f655a1fdcbe5c5cd2cfe0b548a2b4a3a81901a372dc82197667d515d.exe"
1⤵
- Drops file in Windows directory
PID:1632

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1632-54-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download
memory/1632-55-0x0000000000170000-0x000000000019F000-memory.dmp

Filesize
188KB

Download
memory/1632-59-0x0000000000020000-0x0000000000040000-memory.dmp

Filesize
128KB

Download
memory/1632-60-0x0000000000020000-0x0000000000040000-memory.dmp

Filesize
128KB

Download