abe9d267cf2fec6fb1cbc8f0c339a405883c551973af427f8cbe2f0997a83fc7

Analysis

max time kernel
181s
max time network
184s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 04:09

Target

abe9d267cf2fec6fb1cbc8f0c339a405883c551973af427f8cbe2f0997a83fc7.exe
Size

300KB
MD5

925f8bc871b1341192e94b6bc02abc6c
SHA1

20f92602de5f98d701bef2509ad92ecfee8ecd47
SHA256

abe9d267cf2fec6fb1cbc8f0c339a405883c551973af427f8cbe2f0997a83fc7
SHA512

9d21bd9fba08a49478a3dbd260a270903b92780943a912730f6fee87f1c4d970876966d09af06cc97fcf8cb48db90c5fff0e1f29365e21cb38bfcc3a7b951ebd
SSDEEP

6144:62swW0P57gZx2Tx7ScX2H8EdB4rWgVg3cml:6jvGXVMBVgVbml

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops file in Windows directory 1 IoCs

Processes:

abe9d267cf2fec6fb1cbc8f0c339a405883c551973af427f8cbe2f0997a83fc7.exe

description ioc process

File created C:\Windows\Tasks\MadTrends.job abe9d267cf2fec6fb1cbc8f0c339a405883c551973af427f8cbe2f0997a83fc7.exe

description	ioc	process
File created	C:\Windows\Tasks\MadTrends.job	abe9d267cf2fec6fb1cbc8f0c339a405883c551973af427f8cbe2f0997a83fc7.exe

C:\Users\Admin\AppData\Local\Temp\abe9d267cf2fec6fb1cbc8f0c339a405883c551973af427f8cbe2f0997a83fc7.exe
"C:\Users\Admin\AppData\Local\Temp\abe9d267cf2fec6fb1cbc8f0c339a405883c551973af427f8cbe2f0997a83fc7.exe"
1⤵
- Drops file in Windows directory
PID:688

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/688-54-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download
memory/688-55-0x00000000002A0000-0x00000000002CF000-memory.dmp

Filesize
188KB

Download