8440257372515012226efb9459b5b0eea3e37e3b8d166154edd2a055de8dfcff

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
31/10/2022, 04:19

Target

8440257372515012226efb9459b5b0eea3e37e3b8d166154edd2a055de8dfcff.exe
Size

2.3MB
MD5

139a7ac7ed878636960070ecdb52e9ca
SHA1

f808a599104cdeca6e7c6e96c117d82b5fa117eb
SHA256

8440257372515012226efb9459b5b0eea3e37e3b8d166154edd2a055de8dfcff
SHA512

3899fe6d6b280466b14669672fb0fe567805060cec64343d3a99134e1bf1c354b0591cd5c849501f666d9b14f5612782eadfad56db23ba351599f5b6d4e6d300
SSDEEP

12288:kfdvElIVwCbeKFrhGZ2SJy7ntMt+IBHNNt1BY3uAtW/lP7pMw9iRyaqp63f3e/mp:EdNwCbeKF3tM7X/RNT9yyadP3e/k9T

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1492	8440257372515012226efb9459b5b0eea3e37e3b8d166154edd2a055de8dfcff.exe
1492	8440257372515012226efb9459b5b0eea3e37e3b8d166154edd2a055de8dfcff.exe

C:\Users\Admin\AppData\Local\Temp\8440257372515012226efb9459b5b0eea3e37e3b8d166154edd2a055de8dfcff.exe
"C:\Users\Admin\AppData\Local\Temp\8440257372515012226efb9459b5b0eea3e37e3b8d166154edd2a055de8dfcff.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1492

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1492-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download