a9a458aecf0828b8195500d7df442318fc5745ddfb37d19012243f40a5edf252

Analysis

max time kernel
164s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2022 10:07

Target

a9a458aecf0828b8195500d7df442318fc5745ddfb37d19012243f40a5edf252.exe
Size

141KB
MD5

13b51a69f3344b6ba1441e2cd7d80680
SHA1

832af0042a65d6ae7ce5852277b140c060159e18
SHA256

a9a458aecf0828b8195500d7df442318fc5745ddfb37d19012243f40a5edf252
SHA512

28f09bf395e52a6b87cabc4e6eeb84db2c674ac2c2d34c85596491d8f1679cb51ce282bad41ff5289df1c95fed3b052874b0cc5efe55132847c3e9863d6e64a4
SSDEEP

3072:0z2SK2+bBV6Li8qvWBHT7GMKGAXVo1OO:0qRSLXqvWBHPGMg+

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a9a458aecf0828b8195500d7df442318fc5745ddfb37d19012243f40a5edf252.exe

pid	process
1952	a9a458aecf0828b8195500d7df442318fc5745ddfb37d19012243f40a5edf252.exe
1952	a9a458aecf0828b8195500d7df442318fc5745ddfb37d19012243f40a5edf252.exe

C:\Users\Admin\AppData\Local\Temp\a9a458aecf0828b8195500d7df442318fc5745ddfb37d19012243f40a5edf252.exe
"C:\Users\Admin\AppData\Local\Temp\a9a458aecf0828b8195500d7df442318fc5745ddfb37d19012243f40a5edf252.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1952

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1952-132-0x0000000001000000-0x000000000102E000-memory.dmp

Filesize
184KB

Download
memory/1952-133-0x0000000001000000-0x000000000102E000-memory.dmp

Filesize
184KB

Download
memory/1952-139-0x00000000001C0000-0x00000000001C3000-memory.dmp

Filesize
12KB

Download