5668c99f920f0a36425a369b8072ff3e47e616bb2fb11e12290d33cdcb47eb58

Analysis

max time kernel
127s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20-04-2023 00:59

Target

5668c99f920f0a36425a369b8072ff3e47e616bb2fb11e12290d33cdcb47eb58.exe
Size

990KB
MD5

4d1784be6d9005cca3940903394316bd
SHA1

084107c81acd59bba415eae597fa741d807831d6
SHA256

5668c99f920f0a36425a369b8072ff3e47e616bb2fb11e12290d33cdcb47eb58
SHA512

7a127999f04c4a7214e1aa54104ad86ee7eebddef9a158de8e8efc69e1b872894bdd3a0b623358465378c1ddb8a48e45a64214f68ee137e93163ec2223f1c142
SSDEEP

24576:o5CvHHvH7MgHZTDtSxxrBn+Mzn9GA+MMlEqH60jBHFXGo:pj5TDtSHIC98qqHPjBHFV

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1132	5668c99f920f0a36425a369b8072ff3e47e616bb2fb11e12290d33cdcb47eb58.exe

C:\Users\Admin\AppData\Local\Temp\5668c99f920f0a36425a369b8072ff3e47e616bb2fb11e12290d33cdcb47eb58.exe
"C:\Users\Admin\AppData\Local\Temp\5668c99f920f0a36425a369b8072ff3e47e616bb2fb11e12290d33cdcb47eb58.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1132

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact