ef27777325a0808b87c6da42131a9bcdfe9a24667cbb5dc84711d26eeff9944b

Analysis

max time kernel
29s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 06:22

Target

ef27777325a0808b87c6da42131a9bcdfe9a24667cbb5dc84711d26eeff9944b.exe
Size

2.0MB
MD5

850c4d4323f13c3c9d6d2cecb6dd2487
SHA1

4bce1c470d536928bb63e763be612889bcbc398a
SHA256

ef27777325a0808b87c6da42131a9bcdfe9a24667cbb5dc84711d26eeff9944b
SHA512

5f1742ceae82c72aeaa58775b00dcb35d0b6c52550837156725ff1eb4fa0fce7a18f32c03bf6aa40ed3e8aabf1e61d91291f17248e90e7f07efa744d4b16ac17
SSDEEP

6144:1+fbHVsy3PK3qkddowJS/0Ue9u04VaON/rjdz/e0HHJMkihHMVFn2XFcsX:o5d0FJSxguD7Nd/pnKkwHMVF2XKsX

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Bidaily Synchronize Task[pr].job	ef27777325a0808b87c6da42131a9bcdfe9a24667cbb5dc84711d26eeff9944b.exe

C:\Users\Admin\AppData\Local\Temp\ef27777325a0808b87c6da42131a9bcdfe9a24667cbb5dc84711d26eeff9944b.exe
"C:\Users\Admin\AppData\Local\Temp\ef27777325a0808b87c6da42131a9bcdfe9a24667cbb5dc84711d26eeff9944b.exe"
1⤵
- Drops file in Windows directory
PID:1700

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1700-54-0x0000000076651000-0x0000000076653000-memory.dmp

Filesize
8KB

Download
memory/1700-55-0x00000000002C0000-0x00000000002EF000-memory.dmp

Filesize
188KB

Download