22ad3daab3dee889af97ba4ce6e4f4ae20d442678e13a4dee719b7bd59f1fc2c

Analysis

max time kernel
32s
max time network
73s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 16:57

Target

22ad3daab3dee889af97ba4ce6e4f4ae20d442678e13a4dee719b7bd59f1fc2c.exe
Size

284KB
MD5

35f4354db42c39d97c07163e51bc8ab1
SHA1

f1c701b560d164ccf967c00c07492b16c9ffcd4b
SHA256

22ad3daab3dee889af97ba4ce6e4f4ae20d442678e13a4dee719b7bd59f1fc2c
SHA512

ab055db8863c8c2eec004454a48c0a4e0db02fab1db755fdf95a1d8b752f667dcbc2d1f0a2cfbbb1a9e138923477ad32d87d4d5c3532c0307932a3dd96f084f2
SSDEEP

6144:oec0LOgeL2Hbxm+O9kbcXbbOc+aCkjQah:RhqKi6bzcjjQah

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

Processes:

22ad3daab3dee889af97ba4ce6e4f4ae20d442678e13a4dee719b7bd59f1fc2c.exe

description	ioc	process
File created	C:\Windows\Tasks\Bidaily Synchronize Task[973b].job	22ad3daab3dee889af97ba4ce6e4f4ae20d442678e13a4dee719b7bd59f1fc2c.exe

C:\Users\Admin\AppData\Local\Temp\22ad3daab3dee889af97ba4ce6e4f4ae20d442678e13a4dee719b7bd59f1fc2c.exe
"C:\Users\Admin\AppData\Local\Temp\22ad3daab3dee889af97ba4ce6e4f4ae20d442678e13a4dee719b7bd59f1fc2c.exe"
1⤵
- Drops file in Windows directory
PID:1800

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1800-54-0x0000000075771000-0x0000000075773000-memory.dmp

Filesize
8KB

Download
memory/1800-55-0x0000000000110000-0x000000000013F000-memory.dmp

Filesize
188KB

Download