8bab7c9958569ec13846f72c847d6c004503ddf08193c101d58f43c4ecee09fa

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/10/2022, 18:43

Target

8bab7c9958569ec13846f72c847d6c004503ddf08193c101d58f43c4ecee09fa.exe
Size

315KB
MD5

74b94fda6153169f6bf840e24137b478
SHA1

190076136bc0d6c128cfa9047ed37e83a3a7ba5c
SHA256

8bab7c9958569ec13846f72c847d6c004503ddf08193c101d58f43c4ecee09fa
SHA512

0a8f97b41b5db223f56a13005fb44475856ae0a2777bb01038b4a49f6616864f5947ddcf3afeee2d9146a616990bc0c8af3287fdbb08a914f2c28bf0c612c998
SSDEEP

6144:jp13lP19b5dRT22HUHcLX12Bz2g729LRKGpPgY01Im:1PxjycLl2B6OKLRtp4f1Im

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\SafeCaffeine.job	8bab7c9958569ec13846f72c847d6c004503ddf08193c101d58f43c4ecee09fa.exe

C:\Users\Admin\AppData\Local\Temp\8bab7c9958569ec13846f72c847d6c004503ddf08193c101d58f43c4ecee09fa.exe
"C:\Users\Admin\AppData\Local\Temp\8bab7c9958569ec13846f72c847d6c004503ddf08193c101d58f43c4ecee09fa.exe"
1⤵
- Drops file in Windows directory
PID:1168

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1168-54-0x00000000760E1000-0x00000000760E3000-memory.dmp

Filesize
8KB

Download
memory/1168-55-0x00000000001B0000-0x00000000001DF000-memory.dmp

Filesize
188KB

Download