ad200c3fc5b5f07dcd2be2e86a715923f62770771fbd078359022a3fa33a657d

Analysis

max time kernel
50s
max time network
80s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 05:25

Target

ad200c3fc5b5f07dcd2be2e86a715923f62770771fbd078359022a3fa33a657d.exe
Size

248KB
MD5

54fc0870d4f9f6931204eb3bde69b5c2
SHA1

208c515ba966ad4a40c0c090da02228bc8d61f76
SHA256

ad200c3fc5b5f07dcd2be2e86a715923f62770771fbd078359022a3fa33a657d
SHA512

2ff4749291c71d4b3671da4a6d78884ffed234b37d01f186de3342375304901fbc8357c7cc181ef950c61e24a5cebdbc433f62c7370a28ace69eb7075b93f47e
SSDEEP

6144:sv9iFIojoenFYoJ1Ev5vrehBeOMMDQd6FH5oY:ykFie1aqDQMp5oY

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\HyperDock.job	ad200c3fc5b5f07dcd2be2e86a715923f62770771fbd078359022a3fa33a657d.exe

C:\Users\Admin\AppData\Local\Temp\ad200c3fc5b5f07dcd2be2e86a715923f62770771fbd078359022a3fa33a657d.exe
"C:\Users\Admin\AppData\Local\Temp\ad200c3fc5b5f07dcd2be2e86a715923f62770771fbd078359022a3fa33a657d.exe"
1⤵
- Drops file in Windows directory
PID:1200

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1200-54-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/1200-55-0x0000000000210000-0x000000000023F000-memory.dmp

Filesize
188KB

Download