c89d2ad06cada34df0c42f657fa249d5bf1cb41efb5288b0bd90170f1822d8e1

Analysis

max time kernel
138s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 14:33

Target

c89d2ad06cada34df0c42f657fa249d5bf1cb41efb5288b0bd90170f1822d8e1.exe
Size

19KB
MD5

02edded7aecd613fa185e56fddf1e776
SHA1

59add191486032557ab17600b16b9ad2a85ee314
SHA256

c89d2ad06cada34df0c42f657fa249d5bf1cb41efb5288b0bd90170f1822d8e1
SHA512

178174322d58c0c06626e6ebd2363c30b1ecc236a7aa586e2c6a00e80f6c0a7644d6b4cd9321d7e34274f4d5b0dd9304d0045495ad8beda0ed38a553955de4e9
SSDEEP

192:oJuRJgsIH316P4uOx4Zu/H5KZjCnoB29RZ5Adx6o5e8jJred2Xe855deIZJOqdp/:XP4FZKZjREiVJxTew5NJnj7sqz

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3976	c89d2ad06cada34df0c42f657fa249d5bf1cb41efb5288b0bd90170f1822d8e1.exe

C:\Users\Admin\AppData\Local\Temp\c89d2ad06cada34df0c42f657fa249d5bf1cb41efb5288b0bd90170f1822d8e1.exe
"C:\Users\Admin\AppData\Local\Temp\c89d2ad06cada34df0c42f657fa249d5bf1cb41efb5288b0bd90170f1822d8e1.exe"
1⤵
- Suspicious behavior: RenamesItself
PID:3976

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/3976-132-0x0000000000030000-0x000000000003D000-memory.dmp

Filesize
52KB

Download