7efab8642679e8742a7e22bee3e352209bcf2b48d8fde9679bbf3f10c69918d5

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2024, 17:32

Target

7efab8642679e8742a7e22bee3e352209bcf2b48d8fde9679bbf3f10c69918d5.exe
Size

2.4MB
MD5

d0fdccf9d8abf4826f81c8233ead0e5e
SHA1

0a7832df4cadc1545055c67c8f7747996a483752
SHA256

7efab8642679e8742a7e22bee3e352209bcf2b48d8fde9679bbf3f10c69918d5
SHA512

2081a29df5f566ee6bc9de4a925856180e09726281e7fa4eab683ede1df021da25fdf57b299d67320238d73c899c1ca2b0c47eece2e872d72696795e2f7d60af
SSDEEP

49152:Q4jkkUOBux2OXGBG19g7jvFTRP/+TAhZGVDJUIRN5CcCCq:QekHOBg2OX9+d+TAuUa+b

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2292	7efab8642679e8742a7e22bee3e352209bcf2b48d8fde9679bbf3f10c69918d5.exe
2292	7efab8642679e8742a7e22bee3e352209bcf2b48d8fde9679bbf3f10c69918d5.exe
2292	7efab8642679e8742a7e22bee3e352209bcf2b48d8fde9679bbf3f10c69918d5.exe
2292	7efab8642679e8742a7e22bee3e352209bcf2b48d8fde9679bbf3f10c69918d5.exe
2292	7efab8642679e8742a7e22bee3e352209bcf2b48d8fde9679bbf3f10c69918d5.exe
2292	7efab8642679e8742a7e22bee3e352209bcf2b48d8fde9679bbf3f10c69918d5.exe
2292	7efab8642679e8742a7e22bee3e352209bcf2b48d8fde9679bbf3f10c69918d5.exe
2292	7efab8642679e8742a7e22bee3e352209bcf2b48d8fde9679bbf3f10c69918d5.exe
2292	7efab8642679e8742a7e22bee3e352209bcf2b48d8fde9679bbf3f10c69918d5.exe
2292	7efab8642679e8742a7e22bee3e352209bcf2b48d8fde9679bbf3f10c69918d5.exe
2292	7efab8642679e8742a7e22bee3e352209bcf2b48d8fde9679bbf3f10c69918d5.exe
2292	7efab8642679e8742a7e22bee3e352209bcf2b48d8fde9679bbf3f10c69918d5.exe
2292	7efab8642679e8742a7e22bee3e352209bcf2b48d8fde9679bbf3f10c69918d5.exe
2292	7efab8642679e8742a7e22bee3e352209bcf2b48d8fde9679bbf3f10c69918d5.exe
2292	7efab8642679e8742a7e22bee3e352209bcf2b48d8fde9679bbf3f10c69918d5.exe
2292	7efab8642679e8742a7e22bee3e352209bcf2b48d8fde9679bbf3f10c69918d5.exe
2292	7efab8642679e8742a7e22bee3e352209bcf2b48d8fde9679bbf3f10c69918d5.exe
2292	7efab8642679e8742a7e22bee3e352209bcf2b48d8fde9679bbf3f10c69918d5.exe
2292	7efab8642679e8742a7e22bee3e352209bcf2b48d8fde9679bbf3f10c69918d5.exe
2292	7efab8642679e8742a7e22bee3e352209bcf2b48d8fde9679bbf3f10c69918d5.exe

C:\Users\Admin\AppData\Local\Temp\7efab8642679e8742a7e22bee3e352209bcf2b48d8fde9679bbf3f10c69918d5.exe
"C:\Users\Admin\AppData\Local\Temp\7efab8642679e8742a7e22bee3e352209bcf2b48d8fde9679bbf3f10c69918d5.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2292

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact