f0fd7dd39ffbf5194540578c16b7c4c35a0d382f0c8ae377489fa758fbeadba9

Analysis

max time kernel
21s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 04:48

Target

f0fd7dd39ffbf5194540578c16b7c4c35a0d382f0c8ae377489fa758fbeadba9.exe
Size

2.4MB
MD5

d2d1b3fec25c70c383e89e17908989a4
SHA1

cae0b15f28884f44e33b4e6ae3d1d8001b0a7e7f
SHA256

f0fd7dd39ffbf5194540578c16b7c4c35a0d382f0c8ae377489fa758fbeadba9
SHA512

67c95ce7623ba0cf916317ad7d1a9f870331e6bae0897285c6a1e23b2cb4b32fb544f513531f8ae496c434a65bbde6809978c11d0200c3ff0cef92b946a9c091
SSDEEP

6144:rgEKKLRUeUY5vixTwFN4LjV9Yf1YgHkEBvxiJpQYra+XrMkzkf0:LKYNUESTwQLPaxxcWAr4f0

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Bidaily Synchronize Task[973b].job	f0fd7dd39ffbf5194540578c16b7c4c35a0d382f0c8ae377489fa758fbeadba9.exe

C:\Users\Admin\AppData\Local\Temp\f0fd7dd39ffbf5194540578c16b7c4c35a0d382f0c8ae377489fa758fbeadba9.exe
"C:\Users\Admin\AppData\Local\Temp\f0fd7dd39ffbf5194540578c16b7c4c35a0d382f0c8ae377489fa758fbeadba9.exe"
1⤵
- Drops file in Windows directory
PID:2040

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2040-54-0x00000000760B1000-0x00000000760B3000-memory.dmp

Filesize
8KB

Download
memory/2040-55-0x00000000029F0000-0x0000000002A1F000-memory.dmp

Filesize
188KB

Download