a9a458aecf0828b8195500d7df442318fc5745ddfb37d19012243f40a5edf252

Analysis

max time kernel
49s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
08-11-2022 10:07

Target

a9a458aecf0828b8195500d7df442318fc5745ddfb37d19012243f40a5edf252.exe
Size

141KB
MD5

13b51a69f3344b6ba1441e2cd7d80680
SHA1

832af0042a65d6ae7ce5852277b140c060159e18
SHA256

a9a458aecf0828b8195500d7df442318fc5745ddfb37d19012243f40a5edf252
SHA512

28f09bf395e52a6b87cabc4e6eeb84db2c674ac2c2d34c85596491d8f1679cb51ce282bad41ff5289df1c95fed3b052874b0cc5efe55132847c3e9863d6e64a4
SSDEEP

3072:0z2SK2+bBV6Li8qvWBHT7GMKGAXVo1OO:0qRSLXqvWBHPGMg+

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

a9a458aecf0828b8195500d7df442318fc5745ddfb37d19012243f40a5edf252.exe

pid	Process
1256	a9a458aecf0828b8195500d7df442318fc5745ddfb37d19012243f40a5edf252.exe

C:\Users\Admin\AppData\Local\Temp\a9a458aecf0828b8195500d7df442318fc5745ddfb37d19012243f40a5edf252.exe
"C:\Users\Admin\AppData\Local\Temp\a9a458aecf0828b8195500d7df442318fc5745ddfb37d19012243f40a5edf252.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1256

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1256-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1256-55-0x0000000001000000-0x000000000102E000-memory.dmp

Filesize
184KB

Download
memory/1256-61-0x0000000001000000-0x000000000102E000-memory.dmp

Filesize
184KB

Download
memory/1256-62-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download