aba6079380889d44ec7a696118c7f73f6b66d342f7454843c4476cdf93a5de58

Analysis

max time kernel
26s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 07:45

Target

aba6079380889d44ec7a696118c7f73f6b66d342f7454843c4476cdf93a5de58.exe
Size

219KB
MD5

788150d2ff7dd2d19e37e528bf4198ea
SHA1

a1d78e7fcc0243119a1875fe56f347179b224f1c
SHA256

aba6079380889d44ec7a696118c7f73f6b66d342f7454843c4476cdf93a5de58
SHA512

354cd5d69ae2a57600a2ea8a5b603813f2d7aa9b139a357763dded5dd0a5d2b16728c6dbc0af39972e7f3a4c0749d870c5f945f8ea71ae571ebdc43d81aebcae
SSDEEP

3072:Vhj7xIVMcsr6uB/R1pQ43x3a9Lha6nYMgEokO8J03y71SBgb3Q+I7:jpUMVPZ3x38LhqMgEokO8m3y7ooQ+i

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\GetInShape.job	aba6079380889d44ec7a696118c7f73f6b66d342f7454843c4476cdf93a5de58.exe

C:\Users\Admin\AppData\Local\Temp\aba6079380889d44ec7a696118c7f73f6b66d342f7454843c4476cdf93a5de58.exe
"C:\Users\Admin\AppData\Local\Temp\aba6079380889d44ec7a696118c7f73f6b66d342f7454843c4476cdf93a5de58.exe"
1⤵
- Drops file in Windows directory
PID:880

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/880-54-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/880-55-0x00000000001A0000-0x00000000001CF000-memory.dmp

Filesize
188KB

Download