26bfbbf7dcc314079a3bcece08beda0e7df11fbed3896e05b00a394f1ac26d1a

Analysis

max time kernel
38s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 20:48

Target

26bfbbf7dcc314079a3bcece08beda0e7df11fbed3896e05b00a394f1ac26d1a.exe
Size

345KB
MD5

6701167841a353e32d91808acd4d6a69
SHA1

ada3c04497db27800a0ff46ba5699651f95b5d03
SHA256

26bfbbf7dcc314079a3bcece08beda0e7df11fbed3896e05b00a394f1ac26d1a
SHA512

f67cc06ed66e66b6cf30caa2053fe6dc9d9911dc9743fb805ab1bb41567df9dd1207a8d0b69169bc5e80e762fae3b6498d9df7d74ef7ef0f503ae761aeee6954
SSDEEP

6144:EiykHv1GLJDGXNbV2/EDlS5kghtGMhZm366GOQlmw7MZ9QR4e+nV:4kHsJoVD0mgjZm3vmmwIvQR4eQV

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\CookieFinder.job	26bfbbf7dcc314079a3bcece08beda0e7df11fbed3896e05b00a394f1ac26d1a.exe

C:\Users\Admin\AppData\Local\Temp\26bfbbf7dcc314079a3bcece08beda0e7df11fbed3896e05b00a394f1ac26d1a.exe
"C:\Users\Admin\AppData\Local\Temp\26bfbbf7dcc314079a3bcece08beda0e7df11fbed3896e05b00a394f1ac26d1a.exe"
1⤵
- Drops file in Windows directory
PID:2024

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2024-54-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download
memory/2024-55-0x00000000002B0000-0x00000000002DF000-memory.dmp

Filesize
188KB

Download