16e04f642c910df87e272e0d1ef2c908f7796963556fb6b4b31ed1a348ae6dd9

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 21:09

Target

Uninstall.exe
Size

524KB
MD5

1fd89c707179569903b4522d5b47c179
SHA1

3fe9d9e2690b76bfb0d4041091f4f3a5998e5667
SHA256

dd24746a2d0548cf205c9de1825a59bfb1da37cf402ad3f6721780a570b17c8c
SHA512

0740e6e739f513b258bd4737e22174d4dbad52bcf279cd0f45f3c39b27df45891f562c32dfaf0254a6225f276b7b6ea53a00e4c8da17d4a1f6f56d658e23f774
SSDEEP

12288:Egllhn3uuZLFbCatGM8q0VhnMvgAxZADkFxfxruuN3O:EenZxhMhnMX3ADuxKuN3O

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 8 IoCs

C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3636

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact