262b5fb2893d00973d94a9459fa38364eac883e75a5191afbf601c12ddd15492

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-12-2022 18:28

Target

262b5fb2893d00973d94a9459fa38364eac883e75a5191afbf601c12ddd15492.exe
Size

1016KB
MD5

fcbdc5b2fa325fe57764cf75f8ae95b7
SHA1

a039f8db9a3d2ecc77bdf0b418287edba7fefe4c
SHA256

262b5fb2893d00973d94a9459fa38364eac883e75a5191afbf601c12ddd15492
SHA512

2de19719774d6ca0b0c649cfa08478edac9a0e104646db568c1e03402f253031e07d84985b2c90da52666af2ee2a261f089b09f1b6c08982b2eda08f27e04688
SSDEEP

24576:i4ifVljKpR7lbZUf9h7y9cYzXM30wcX2ALUG:i9A7m9h7DYr8cX2Ax

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1784	262b5fb2893d00973d94a9459fa38364eac883e75a5191afbf601c12ddd15492.exe
1784	262b5fb2893d00973d94a9459fa38364eac883e75a5191afbf601c12ddd15492.exe

C:\Users\Admin\AppData\Local\Temp\262b5fb2893d00973d94a9459fa38364eac883e75a5191afbf601c12ddd15492.exe
"C:\Users\Admin\AppData\Local\Temp\262b5fb2893d00973d94a9459fa38364eac883e75a5191afbf601c12ddd15492.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1784

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1784-54-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download
memory/1784-55-0x0000000000671000-0x0000000000673000-memory.dmp

Filesize
8KB

Download
memory/1784-57-0x0000000000671000-0x0000000000674000-memory.dmp

Filesize
12KB

Download