307680f7fd5bd0e5828ed3d52450300b27acc575d3d62a6110a81a691a5cab56

Analysis

max time kernel
224s
max time network
267s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 19:29

Target

307680f7fd5bd0e5828ed3d52450300b27acc575d3d62a6110a81a691a5cab56.exe
Size

106KB
MD5

48d3bf05a73a55954c2039bf11dfa124
SHA1

64c96b327a5594a77b20dcc6d1ca4b23d098725f
SHA256

307680f7fd5bd0e5828ed3d52450300b27acc575d3d62a6110a81a691a5cab56
SHA512

967fe52bd22572dfcaa6a43003b2e529bedb602b93c7790a0ca848380df51e1b947a6f4651049fb9960439617103247e42d349bad825370b19faed374a2062b7
SSDEEP

1536:rBpof24LqWkntFFUx4oDiSxVkw475f7IiYFfmdnU70Er4BvHQK:rBifeWaF0qSxu79YlmdO0E8BvP

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

307680f7fd5bd0e5828ed3d52450300b27acc575d3d62a6110a81a691a5cab56.exe

pid process

112 307680f7fd5bd0e5828ed3d52450300b27acc575d3d62a6110a81a691a5cab56.exe

pid	process
112	307680f7fd5bd0e5828ed3d52450300b27acc575d3d62a6110a81a691a5cab56.exe

C:\Users\Admin\AppData\Local\Temp\307680f7fd5bd0e5828ed3d52450300b27acc575d3d62a6110a81a691a5cab56.exe
"C:\Users\Admin\AppData\Local\Temp\307680f7fd5bd0e5828ed3d52450300b27acc575d3d62a6110a81a691a5cab56.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:112

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/112-132-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download