5620facc0c785fcfb5ea670d24091f7baf570a6cf0a79e4f12622de8a00ef71b

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 12:28

Target

5620facc0c785fcfb5ea670d24091f7baf570a6cf0a79e4f12622de8a00ef71b.exe
Size

306KB
MD5

14c4551db754c4f6049f6292ab6f4a03
SHA1

6bad0cab8170539c2abc7c943fafde366de41665
SHA256

5620facc0c785fcfb5ea670d24091f7baf570a6cf0a79e4f12622de8a00ef71b
SHA512

80a48c1ac6f42cefc957820d3564999f05056b19706e1092e49023fdc10e5cae38e3d96f15ca7f6128753c653178b058e6c683c996652e754c3a7d06f501a6ad
SSDEEP

6144:UrSATwIehkkZF9Qy/uuTTDFHwGsA44Thuhce91Fr:gSATwx1T1TDFQGh44Qhc2jr

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\GestureControls.job	5620facc0c785fcfb5ea670d24091f7baf570a6cf0a79e4f12622de8a00ef71b.exe

C:\Users\Admin\AppData\Local\Temp\5620facc0c785fcfb5ea670d24091f7baf570a6cf0a79e4f12622de8a00ef71b.exe
"C:\Users\Admin\AppData\Local\Temp\5620facc0c785fcfb5ea670d24091f7baf570a6cf0a79e4f12622de8a00ef71b.exe"
1⤵
- Drops file in Windows directory
PID:1056

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1056-54-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download
memory/1056-55-0x0000000000380000-0x00000000003AF000-memory.dmp

Filesize
188KB

Download
memory/1056-59-0x00000000001E0000-0x0000000000213000-memory.dmp

Filesize
204KB

Download
memory/1056-60-0x00000000001E0000-0x0000000000213000-memory.dmp

Filesize
204KB

Download