56c0654a5c1df481ca0447625b278197f2a214c0aab2df42d421363e400eaf6f

Analysis

max time kernel
145s
max time network
154s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
25-07-2022 01:49

Target

56c0654a5c1df481ca0447625b278197f2a214c0aab2df42d421363e400eaf6f.exe
Size

283KB
MD5

584cbbb572a0834d617e2af97b65cdf8
SHA1

db3d7ec399b3384ab4701d056ace08adbd28ca63
SHA256

56c0654a5c1df481ca0447625b278197f2a214c0aab2df42d421363e400eaf6f
SHA512

e4b991dbe4d8ed10532dae2aafc08541851ba0fb012c036cb294fa4ad9d62435697326d4adf5ad9b49f25842c3a1322c8fbda567a9cf5fe58dfaefa4f91d61c0

Score

10^/10

suricata: ET MALWARE ETag HTTP Header Observed at JPCERT Sinkhole
suricata: ET MALWARE ETag HTTP Header Observed at JPCERT Sinkhole
suricata
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops file in Windows directory 1 IoCs

Processes:

56c0654a5c1df481ca0447625b278197f2a214c0aab2df42d421363e400eaf6f.exe

description ioc process

File created C:\Windows\Tasks\PasswordKeeper+.job 56c0654a5c1df481ca0447625b278197f2a214c0aab2df42d421363e400eaf6f.exe

description	ioc	process
File created	C:\Windows\Tasks\PasswordKeeper+.job	56c0654a5c1df481ca0447625b278197f2a214c0aab2df42d421363e400eaf6f.exe

C:\Users\Admin\AppData\Local\Temp\56c0654a5c1df481ca0447625b278197f2a214c0aab2df42d421363e400eaf6f.exe
"C:\Users\Admin\AppData\Local\Temp\56c0654a5c1df481ca0447625b278197f2a214c0aab2df42d421363e400eaf6f.exe"
1⤵
- Drops file in Windows directory
PID:992

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/992-54-0x0000000075441000-0x0000000075443000-memory.dmp

Filesize
8KB

Download
memory/992-55-0x0000000000340000-0x000000000036F000-memory.dmp

Filesize
188KB

Download