2a95310a57255a27490d2c9e8024f8d9f2d98bf64836f7ddecde90eb799a8d5e

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 13:47

Target

2a95310a57255a27490d2c9e8024f8d9f2d98bf64836f7ddecde90eb799a8d5e.exe
Size

283KB
MD5

09df460e6f9527c73091db97c3a0ea60
SHA1

1f0a830d58058d6d989853273a5c06089f06336f
SHA256

2a95310a57255a27490d2c9e8024f8d9f2d98bf64836f7ddecde90eb799a8d5e
SHA512

c258a78266f15ff4f93ccb3be16a54bd652c16083e6545fa05fc18a2b61ee6f81ccfa0f5182bac3bed4b36308718b70b339efebec9370fc499421937cdd0513a
SSDEEP

3072:5pdpcTR1ej9WHEiptJjjLSJ9Viw88hAy6t5YUWcdY7xhAuwsHzMt02c18zpP/LGh:5PpJHij5eJniL5YUtdY9eEzMfdrGhEQ

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Bidaily Synchronize Task[973b].job	2a95310a57255a27490d2c9e8024f8d9f2d98bf64836f7ddecde90eb799a8d5e.exe

C:\Users\Admin\AppData\Local\Temp\2a95310a57255a27490d2c9e8024f8d9f2d98bf64836f7ddecde90eb799a8d5e.exe
"C:\Users\Admin\AppData\Local\Temp\2a95310a57255a27490d2c9e8024f8d9f2d98bf64836f7ddecde90eb799a8d5e.exe"
1⤵
- Drops file in Windows directory
PID:1972

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1972-54-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download
memory/1972-55-0x0000000000110000-0x000000000013F000-memory.dmp

Filesize
188KB

Download