af049be73371a57f82d14a56c4ef79c6bb86a06e34c92b7df3215f6eaa32f407

Analysis

max time kernel
82s
max time network
124s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 14:14

Target

af049be73371a57f82d14a56c4ef79c6bb86a06e34c92b7df3215f6eaa32f407.exe
Size

297KB
MD5

24f516ff713ec2dae03e9420c1651fc0
SHA1

9e6e295a777599dc3d73e6acfffd5493738a2fcc
SHA256

af049be73371a57f82d14a56c4ef79c6bb86a06e34c92b7df3215f6eaa32f407
SHA512

80e4d27648bc37e6be7b4251800c3d0dade6d07587336c0709911f221a4494184840316699c6ebcccedec7c20d4995c6221ff17ec69592b2c42e7122d2d768b8
SSDEEP

3072:NFphty0BsG+UlTIUOeDHNuddjslBa7G5+XJHYy0BKVnIuHIUM0NHcpXRIzqUwF:JhIgv2dj0ByeyvVnIu/ViOmUo

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\MomentCapture.job	af049be73371a57f82d14a56c4ef79c6bb86a06e34c92b7df3215f6eaa32f407.exe

C:\Users\Admin\AppData\Local\Temp\af049be73371a57f82d14a56c4ef79c6bb86a06e34c92b7df3215f6eaa32f407.exe
"C:\Users\Admin\AppData\Local\Temp\af049be73371a57f82d14a56c4ef79c6bb86a06e34c92b7df3215f6eaa32f407.exe"
1⤵
- Drops file in Windows directory
PID:956

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/956-54-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/956-55-0x00000000000F0000-0x000000000011F000-memory.dmp

Filesize
188KB

Download
memory/956-59-0x0000000001431000-0x0000000001452000-memory.dmp

Filesize
132KB

Download
memory/956-60-0x0000000001431000-0x0000000001452000-memory.dmp

Filesize
132KB

Download