abb36185e3d4e9c40a4cd36dd987b091eea11f5561cb92ac39d9257986cd7bf7

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 07:17

Target

abb36185e3d4e9c40a4cd36dd987b091eea11f5561cb92ac39d9257986cd7bf7.exe
Size

346KB
MD5

0bd960e6b99a232c08e7f8d6bf797804
SHA1

1b0fd3ef18ab2315e1cf280db55dba5796bf5c0b
SHA256

abb36185e3d4e9c40a4cd36dd987b091eea11f5561cb92ac39d9257986cd7bf7
SHA512

a235e2de13ae09268f68755bd08226a2fca0c29d6c6e66f6f47680587f6300ae2bf79246e709f1bc48424e613fed7bc210011c1ad2b484dcb28fbd15b0daf600
SSDEEP

6144:GlTz4zkHIPWf7gB2azTzcdoM79TvjIUPajAdUdpnA:GlTzzHtvazcCk97jHQpnA

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\RestoGuide.job	abb36185e3d4e9c40a4cd36dd987b091eea11f5561cb92ac39d9257986cd7bf7.exe

C:\Users\Admin\AppData\Local\Temp\abb36185e3d4e9c40a4cd36dd987b091eea11f5561cb92ac39d9257986cd7bf7.exe
"C:\Users\Admin\AppData\Local\Temp\abb36185e3d4e9c40a4cd36dd987b091eea11f5561cb92ac39d9257986cd7bf7.exe"
1⤵
- Drops file in Windows directory
PID:1948

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1948-54-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download
memory/1948-55-0x00000000003B0000-0x00000000003DF000-memory.dmp

Filesize
188KB

Download