067eaf360458682f4841cd3911e9256896e65cc0cf9e4c8b664d17a2230a4021

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 18:16

Target

067eaf360458682f4841cd3911e9256896e65cc0cf9e4c8b664d17a2230a4021.exe
Size

549KB
MD5

8206efdde39e94ad5fe0d4d52d2fc0bb
SHA1

f3bf22ad3635edcca462f7b4440997df7db5d86a
SHA256

067eaf360458682f4841cd3911e9256896e65cc0cf9e4c8b664d17a2230a4021
SHA512

7b988ef2fda1b73976de6b9dff309c0b6930263c6ebdaf1f9048fda9d08179e9517c703a519275fcabdbd7ad1ec89c1b947873e985fda3e172051aca6a869c11
SSDEEP

12288:1LQ6T8FEox8H3Z5bjQCYTtVnSzyIzQ+q3ZYJoy:FNT8FEox8H3Z5XFS/nSzyIz9qLy

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
640	067eaf360458682f4841cd3911e9256896e65cc0cf9e4c8b664d17a2230a4021.exe

C:\Users\Admin\AppData\Local\Temp\067eaf360458682f4841cd3911e9256896e65cc0cf9e4c8b664d17a2230a4021.exe
"C:\Users\Admin\AppData\Local\Temp\067eaf360458682f4841cd3911e9256896e65cc0cf9e4c8b664d17a2230a4021.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:640

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact