8060976d90bcadff0bcd05134c25e4eab0987671276050fb3a96e4eb0ddddd76

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 01:02

Target

8060976d90bcadff0bcd05134c25e4eab0987671276050fb3a96e4eb0ddddd76.exe
Size

282KB
MD5

7429aeacda68934c63331349f36b4ed0
SHA1

619712961e7dd5d062a2327d3c12fd6234b72ef1
SHA256

8060976d90bcadff0bcd05134c25e4eab0987671276050fb3a96e4eb0ddddd76
SHA512

750a7ad08edf781805c6c861b3d396b306ef0a2f5e5b12af25114edc4921937bf79e152fcfa826ab29d25913460efb4143e1491223aa69c69c905cdef85f9026
SSDEEP

3072:usxLJ5D9PsfxCAjH+Y/pxmzkVlcK/XFB7orpP+n6uU1WkUtIeMf3w//02e:ZFJ1mxC8jykzjMdPq6d1W4g/Je

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\PasswordKeeper+.job	8060976d90bcadff0bcd05134c25e4eab0987671276050fb3a96e4eb0ddddd76.exe

C:\Users\Admin\AppData\Local\Temp\8060976d90bcadff0bcd05134c25e4eab0987671276050fb3a96e4eb0ddddd76.exe
"C:\Users\Admin\AppData\Local\Temp\8060976d90bcadff0bcd05134c25e4eab0987671276050fb3a96e4eb0ddddd76.exe"
1⤵
- Drops file in Windows directory
PID:2008

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2008-54-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download
memory/2008-55-0x0000000000130000-0x000000000015F000-memory.dmp

Filesize
188KB

Download
memory/2008-59-0x00000000002B1000-0x00000000002D2000-memory.dmp

Filesize
132KB

Download
memory/2008-60-0x00000000002B1000-0x00000000002D2000-memory.dmp

Filesize
132KB

Download