b643742928fc2a2eb5dabf5f58202938f24a0f322503e74ede27ed1457068bb5

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 02:38

Target

b643742928fc2a2eb5dabf5f58202938f24a0f322503e74ede27ed1457068bb5.exe
Size

472KB
MD5

42f5383d9a63b479f13ee3642d53c0fa
SHA1

39483ac92992493a4f9364033ca6f84f27152fec
SHA256

b643742928fc2a2eb5dabf5f58202938f24a0f322503e74ede27ed1457068bb5
SHA512

d983ba76c125906c053301c7c3ceb85d062321fc243da54ccb18ad52e7e3621549f33302fd2c7ba6d52b9f0137056371fc130617dc23d5f091a9e8568bad8fa0
SSDEEP

12288:J8gSZp5aBhxeH3Z5bbGv5a5Kw13ikTNLIKD:8ZpcBhxeH3Z5vj5Kw13BxTD

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1276	b643742928fc2a2eb5dabf5f58202938f24a0f322503e74ede27ed1457068bb5.exe

C:\Users\Admin\AppData\Local\Temp\b643742928fc2a2eb5dabf5f58202938f24a0f322503e74ede27ed1457068bb5.exe
"C:\Users\Admin\AppData\Local\Temp\b643742928fc2a2eb5dabf5f58202938f24a0f322503e74ede27ed1457068bb5.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1276

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact