f6c3b01b7361ca739392bc91a394e801d681bd3250aa6c926d769766e1962220

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 05:46

Target

f6c3b01b7361ca739392bc91a394e801d681bd3250aa6c926d769766e1962220.exe
Size

2.5MB
MD5

6d986c900a6826639d783dbce196b024
SHA1

d9e1a8c956439a0461aa086cfa479aceedf4908f
SHA256

f6c3b01b7361ca739392bc91a394e801d681bd3250aa6c926d769766e1962220
SHA512

0fd6fabc5d14422e780bf32e04f2a9dbf164ce0197cf8439959675d6cf7bb1e1c02e68ccfe7a416ef60c047792df346f6efbb81b39e6556dffe1114b9cb51abc
SSDEEP

6144:IFCDaoJbXLe43nVcb6FwNkTS9jXpJ3XGKHESjZIwpee9Er6:W2pLe43ab6S+TwXpJXGKkbARyr6

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Bidaily Synchronize Task[973b].job	f6c3b01b7361ca739392bc91a394e801d681bd3250aa6c926d769766e1962220.exe

C:\Users\Admin\AppData\Local\Temp\f6c3b01b7361ca739392bc91a394e801d681bd3250aa6c926d769766e1962220.exe
"C:\Users\Admin\AppData\Local\Temp\f6c3b01b7361ca739392bc91a394e801d681bd3250aa6c926d769766e1962220.exe"
1⤵
- Drops file in Windows directory
PID:1604

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1604-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1604-55-0x0000000000300000-0x000000000032F000-memory.dmp

Filesize
188KB

Download