af5ecc76814c89b8e85c91580bbb1481f81217fbddc9cc8b9f168a980d596dd5

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 11:10

Target

af5ecc76814c89b8e85c91580bbb1481f81217fbddc9cc8b9f168a980d596dd5.exe
Size

296KB
MD5

2a3e7177265f47df82453764c86edf0d
SHA1

3c54bacdeec25e94b4d624bcfd4e86e1309629a9
SHA256

af5ecc76814c89b8e85c91580bbb1481f81217fbddc9cc8b9f168a980d596dd5
SHA512

1fa582aa30e29087268df1a5ed9ea27b194a1468c4585485428774418768645209c9d0ca05fe46c922ba7f53645c5a42359d8ce9d68208198613dc8698cdddd2
SSDEEP

6144:O6z5B71chCVeThl14csOFT+veNQZ4mCAPwpA5l4IVUx:OQ5AhCY7K8LNq4mhPcoUx

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\FrameVid.job	af5ecc76814c89b8e85c91580bbb1481f81217fbddc9cc8b9f168a980d596dd5.exe

C:\Users\Admin\AppData\Local\Temp\af5ecc76814c89b8e85c91580bbb1481f81217fbddc9cc8b9f168a980d596dd5.exe
"C:\Users\Admin\AppData\Local\Temp\af5ecc76814c89b8e85c91580bbb1481f81217fbddc9cc8b9f168a980d596dd5.exe"
1⤵
- Drops file in Windows directory
PID:584

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/584-54-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/584-55-0x00000000001C0000-0x00000000001EF000-memory.dmp

Filesize
188KB

Download