2ad9b362775fe8a5a70ea4707325699123480e2827abdd2893ff566b80e86ea8

Analysis

max time kernel
220s
max time network
267s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 19:29

Target

2ad9b362775fe8a5a70ea4707325699123480e2827abdd2893ff566b80e86ea8.exe
Size

106KB
MD5

01f2a64aa594fceab83bf8818a312a44
SHA1

1707c0f3a4b75c355400bb525fdb9fcc66f0c544
SHA256

2ad9b362775fe8a5a70ea4707325699123480e2827abdd2893ff566b80e86ea8
SHA512

2114ce63afcbf1a39370d0d0e68767f05d26551848529e40a4717d85fdf97aafa8bb4ba38108f6239a4a48602219763100981f6ca19c579a4e746e950d395935
SSDEEP

1536:eo6jFkgkBgaE4bhwll5mHcyu1mKPz8w7A64vHQK:eo6jWgkGE4rmd6mKbqvP

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

2ad9b362775fe8a5a70ea4707325699123480e2827abdd2893ff566b80e86ea8.exe

pid process

2640 2ad9b362775fe8a5a70ea4707325699123480e2827abdd2893ff566b80e86ea8.exe

pid	process
2640	2ad9b362775fe8a5a70ea4707325699123480e2827abdd2893ff566b80e86ea8.exe

C:\Users\Admin\AppData\Local\Temp\2ad9b362775fe8a5a70ea4707325699123480e2827abdd2893ff566b80e86ea8.exe
"C:\Users\Admin\AppData\Local\Temp\2ad9b362775fe8a5a70ea4707325699123480e2827abdd2893ff566b80e86ea8.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2640

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2640-132-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download