4fbdbfe3ce6a080b62c2a6f0ff4b567fcaefb0344e2e954f09c3ab3665617f50

Analysis

max time kernel
93s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 19:55

Target

4fbdbfe3ce6a080b62c2a6f0ff4b567fcaefb0344e2e954f09c3ab3665617f50.exe
Size

2.3MB
MD5

d556ab2e71cab3937ca8bcccf01b1457
SHA1

ae192edb34a24b43b19a0f3fef095640088e5184
SHA256

4fbdbfe3ce6a080b62c2a6f0ff4b567fcaefb0344e2e954f09c3ab3665617f50
SHA512

5c0d2f0430e9e60c88c950d231d013f25bfe34667ea64a8aba9c37a74a88415d92db945b804d1d5633dcf98e773314e3efc65263f1f327303c517371d9fcfb6e
SSDEEP

49152:fn4VCiS1YaDflSXPcPcSv7DyBH9RJ1F4q7NncPOAlOEknNBVwctsZ:f4VCikY2fYXEPdvSBH9cq7Nndseq

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

4fbdbfe3ce6a080b62c2a6f0ff4b567fcaefb0344e2e954f09c3ab3665617f50.exe

pid	process
4588	4fbdbfe3ce6a080b62c2a6f0ff4b567fcaefb0344e2e954f09c3ab3665617f50.exe
4588	4fbdbfe3ce6a080b62c2a6f0ff4b567fcaefb0344e2e954f09c3ab3665617f50.exe
4588	4fbdbfe3ce6a080b62c2a6f0ff4b567fcaefb0344e2e954f09c3ab3665617f50.exe
4588	4fbdbfe3ce6a080b62c2a6f0ff4b567fcaefb0344e2e954f09c3ab3665617f50.exe
4588	4fbdbfe3ce6a080b62c2a6f0ff4b567fcaefb0344e2e954f09c3ab3665617f50.exe
4588	4fbdbfe3ce6a080b62c2a6f0ff4b567fcaefb0344e2e954f09c3ab3665617f50.exe
4588	4fbdbfe3ce6a080b62c2a6f0ff4b567fcaefb0344e2e954f09c3ab3665617f50.exe
4588	4fbdbfe3ce6a080b62c2a6f0ff4b567fcaefb0344e2e954f09c3ab3665617f50.exe
4588	4fbdbfe3ce6a080b62c2a6f0ff4b567fcaefb0344e2e954f09c3ab3665617f50.exe
4588	4fbdbfe3ce6a080b62c2a6f0ff4b567fcaefb0344e2e954f09c3ab3665617f50.exe
4588	4fbdbfe3ce6a080b62c2a6f0ff4b567fcaefb0344e2e954f09c3ab3665617f50.exe
4588	4fbdbfe3ce6a080b62c2a6f0ff4b567fcaefb0344e2e954f09c3ab3665617f50.exe
4588	4fbdbfe3ce6a080b62c2a6f0ff4b567fcaefb0344e2e954f09c3ab3665617f50.exe
4588	4fbdbfe3ce6a080b62c2a6f0ff4b567fcaefb0344e2e954f09c3ab3665617f50.exe
4588	4fbdbfe3ce6a080b62c2a6f0ff4b567fcaefb0344e2e954f09c3ab3665617f50.exe
4588	4fbdbfe3ce6a080b62c2a6f0ff4b567fcaefb0344e2e954f09c3ab3665617f50.exe

C:\Users\Admin\AppData\Local\Temp\4fbdbfe3ce6a080b62c2a6f0ff4b567fcaefb0344e2e954f09c3ab3665617f50.exe
"C:\Users\Admin\AppData\Local\Temp\4fbdbfe3ce6a080b62c2a6f0ff4b567fcaefb0344e2e954f09c3ab3665617f50.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4588

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance