f62a449edfce645e66d87597e7c8f9bfc0b36665b23a12fb973519d9d0c8792d

Analysis

max time kernel
149s
max time network
148s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 05:22

Target

f3bee45e-eaaa-11e6-8f0c-80e65024849a.exe
Size

1.3MB
MD5

f1db409bf1ff8f356cffb4a5546c34a4
SHA1

2179d4d0cb9bc3b1afaac59d05d0b1682108efa9
SHA256

ec52bc159b12ec20621cc6842a16ba4f726919c48ec2e8882f9b5a34c6710763
SHA512

ddfc78ef691aaede9e82a2dd63c2b25eecfbe6d0ce9a83bcffdbbb8a5189538c2808210c0da2ea548497949bd949241aa070667e08e20b3205173d9087a9161f
SSDEEP

24576:aHVXCwzorO85QrktYOBRezSU4vCVHmg74P8BEu2cddRYbhlSG0YdDeMGXXCugvi9:6orO8MktYuRezSU4vCVHmg74P8BJ20R7

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2824	f3bee45e-eaaa-11e6-8f0c-80e65024849a.exe
2824	f3bee45e-eaaa-11e6-8f0c-80e65024849a.exe

C:\Users\Admin\AppData\Local\Temp\f3bee45e-eaaa-11e6-8f0c-80e65024849a.exe
"C:\Users\Admin\AppData\Local\Temp\f3bee45e-eaaa-11e6-8f0c-80e65024849a.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2824

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact