19c14d611e54acffbad7f6630802d5b24c03d7884e373bff8d6d23ca23d66ae0

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 16:57

Target

19c14d611e54acffbad7f6630802d5b24c03d7884e373bff8d6d23ca23d66ae0.exe
Size

209KB
MD5

829a5300f65034927caf4b46b5128d5f
SHA1

f2f1a1749c2ccce7e4a67a73556ffc9a3372b811
SHA256

19c14d611e54acffbad7f6630802d5b24c03d7884e373bff8d6d23ca23d66ae0
SHA512

d4f05bc0af1c51acb65d2b46d9e9b207fcc02409424dcd1c77abc6fe3c8c876d2d51810e6dad6105d023edee3139a81eae7faf4a43ce047fe27b2fa4d5fd9fae
SSDEEP

6144:cZng6jx50IVoIiLEFBHwW0Ph/aaCqc6f91Sr:cRrxm8rieHWqp6f9cr

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

Processes:

19c14d611e54acffbad7f6630802d5b24c03d7884e373bff8d6d23ca23d66ae0.exe

description	ioc	process
File created	C:\Windows\Tasks\Bidaily Synchronize Task[973b].job	19c14d611e54acffbad7f6630802d5b24c03d7884e373bff8d6d23ca23d66ae0.exe

C:\Users\Admin\AppData\Local\Temp\19c14d611e54acffbad7f6630802d5b24c03d7884e373bff8d6d23ca23d66ae0.exe
"C:\Users\Admin\AppData\Local\Temp\19c14d611e54acffbad7f6630802d5b24c03d7884e373bff8d6d23ca23d66ae0.exe"
1⤵
- Drops file in Windows directory
PID:1284

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1284-54-0x00000000762E1000-0x00000000762E3000-memory.dmp

Filesize
8KB

Download
memory/1284-55-0x0000000000110000-0x000000000013F000-memory.dmp

Filesize
188KB

Download
memory/1284-59-0x0000000000020000-0x0000000000040000-memory.dmp

Filesize
128KB

Download