4abaff74d9199149781bdf9c8a436e7ec559ab73d4a7daad2b4421359b5bb11b

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:17

Target

4abaff74d9199149781bdf9c8a436e7ec559ab73d4a7daad2b4421359b5bb11b.exe
Size

64KB
MD5

dafc8350c92fa8825625ce59164b484b
SHA1

d7374eb4a8e341f2e7cd60501882c19c974ca321
SHA256

4abaff74d9199149781bdf9c8a436e7ec559ab73d4a7daad2b4421359b5bb11b
SHA512

89496e16f34f7a52307de676b01f15b8a72b1ecf7191cc59e10ea4b708694d329197729b1ad10f77b2f7181e4172685ddc32bfee7fd6f27fba84543ce24c0275
SSDEEP

768:mHFz/HqG3OUDtyhUsS836/m+MkDrvxlkYA6gN1cNnu3BKkg5uFWABDEmF3T9:wtKG3EzFKzMkDr5l63YkBKkg58HBtZ

Score

8^/10

discovery

Executes dropped EXE 1 IoCs

Processes:

edg7D72.exe

pid process

1692 edg7D72.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1692	edg7D72.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

4abaff74d9199149781bdf9c8a436e7ec559ab73d4a7daad2b4421359b5bb11b.exe

description	pid	process	target process
PID 3836 wrote to memory of 1692	3836	4abaff74d9199149781bdf9c8a436e7ec559ab73d4a7daad2b4421359b5bb11b.exe	edg7D72.exe
PID 3836 wrote to memory of 1692	3836	4abaff74d9199149781bdf9c8a436e7ec559ab73d4a7daad2b4421359b5bb11b.exe	edg7D72.exe
PID 3836 wrote to memory of 1692	3836	4abaff74d9199149781bdf9c8a436e7ec559ab73d4a7daad2b4421359b5bb11b.exe	edg7D72.exe

C:\Users\Admin\AppData\Local\Temp\4abaff74d9199149781bdf9c8a436e7ec559ab73d4a7daad2b4421359b5bb11b.exe
"C:\Users\Admin\AppData\Local\Temp\4abaff74d9199149781bdf9c8a436e7ec559ab73d4a7daad2b4421359b5bb11b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3836

C:\Users\Admin\AppData\Local\edg7D72.exe
C:\Users\Admin\AppData\Local\edg7D72.exe C:\Users\Admin\AppData\Local\Temp\4ABAFF~1.EXE cp
2⤵
- Executes dropped EXE
PID:1692

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\edg7D72.exe

Filesize
64KB

MD5
ca8fdf844df402076d37e85a74fa485b

SHA1
bf1fca6f81b3d5a9054ceab9a56c58f248560b34

SHA256
854d40b9e9e1bb8675dd552db942189f2e83d639756f2639f262dee324ff39ba

SHA512
fec6f89ea40dc704c0c72e7740a0b4faa5a4eca2fb37521a64e569f9fb18ad4384b5ff94b351521a47b0506fbe5e67df6d9274dc7f184f04735a758baaeffaf6

Download Submit
memory/1692-138-0x0000000000000000-mapping.dmp

Download
memory/3836-132-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download