25ec675c0b0188327f6f9eed4a57611c8c046936d129ad453ca7c8ae2cfcc320

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
14/11/2023, 19:13

Target

25ec675c0b0188327f6f9eed4a57611c8c046936d129ad453ca7c8ae2cfcc320.exe
Size

295KB
MD5

4f7a5502ae53bc3902532d0a9791ac73
SHA1

f8225606d22b5536e60ff49bba5e5f6d1ae58039
SHA256

25ec675c0b0188327f6f9eed4a57611c8c046936d129ad453ca7c8ae2cfcc320
SHA512

381e90aaf88e6761a7b836d684a264b239b04555f38d08a796eb17b87342a419771d7a382853a07bf9901081d2eb429a82d603611033db88245ae77a0318f575
SSDEEP

6144:E5AXyktAQ5fhZi5cpndp6flYKB9aJIv/IvJCPKPguS2F3aA:E5AhHhWcndp6flPpgJtf3aA

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2888	25ec675c0b0188327f6f9eed4a57611c8c046936d129ad453ca7c8ae2cfcc320.exe

C:\Users\Admin\AppData\Local\Temp\25ec675c0b0188327f6f9eed4a57611c8c046936d129ad453ca7c8ae2cfcc320.exe
"C:\Users\Admin\AppData\Local\Temp\25ec675c0b0188327f6f9eed4a57611c8c046936d129ad453ca7c8ae2cfcc320.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2888

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact