ea2ad3c39cca62611ec7bf28884fa2477f5c56ca472b5b8d35ecc8b0a28bd720

Analysis

max time kernel
140s
max time network
148s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
21-11-2022 12:16

Target

ea2ad3c39cca62611ec7bf28884fa2477f5c56ca472b5b8d35ecc8b0a28bd720.exe
Size

298KB
MD5

3b29c46825c81c6f32a82f277416cbdf
SHA1

1eee870f4e5956659fa6d52cd61433a9b2bcc517
SHA256

ea2ad3c39cca62611ec7bf28884fa2477f5c56ca472b5b8d35ecc8b0a28bd720
SHA512

09d32e77f8e47e7430818719456a2999cadb22eacccbed79ac3d1987639183c432f00401c24855afbdecd971831e6705915a37264deb2062bb3ed7a0699f67d0
SSDEEP

6144:NHuTbgQLBDgXnkqMDbdJClkQjVhW5yo7Jsg05PaL:NHuTXNDbrClkWW5VNSoL

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\FrequencyCheck.job	ea2ad3c39cca62611ec7bf28884fa2477f5c56ca472b5b8d35ecc8b0a28bd720.exe

C:\Users\Admin\AppData\Local\Temp\ea2ad3c39cca62611ec7bf28884fa2477f5c56ca472b5b8d35ecc8b0a28bd720.exe
"C:\Users\Admin\AppData\Local\Temp\ea2ad3c39cca62611ec7bf28884fa2477f5c56ca472b5b8d35ecc8b0a28bd720.exe"
1⤵
- Drops file in Windows directory
PID:1184

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1184-54-0x0000000075BE1000-0x0000000075BE3000-memory.dmp

Filesize
8KB

Download
memory/1184-55-0x0000000000290000-0x00000000002BF000-memory.dmp

Filesize
188KB

Download
memory/1184-59-0x0000000000210000-0x0000000000242000-memory.dmp

Filesize
200KB

Download
memory/1184-60-0x0000000000210000-0x0000000000242000-memory.dmp

Filesize
200KB

Download