be7dfb01de383a76e4690674ece59cf47077c6bf6098d5af7ef02fd6631996bf

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 23:11

Target

windowskeyfinder.exe
Size

1.1MB
MD5

99d2176b010ed9173e2df94dd12c5b5e
SHA1

e672097258da1e993e7c173554911abf40726218
SHA256

be7dfb01de383a76e4690674ece59cf47077c6bf6098d5af7ef02fd6631996bf
SHA512

91843a427cbeb4e9b34ca7704943ae2c70a2cb69d7691677c584fdbefc37745d374c8efb0fc3a691d0f20bd07a21d452a4f4e56bb40178991dee4bc4e346dfcb
SSDEEP

12288:wBrWgkRgk/dsRAvT+FxW16MvThxqK1NWCO:wB2/uFxzC3qqYCO

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2936	windowskeyfinder.exe
2936	windowskeyfinder.exe

C:\Users\Admin\AppData\Local\Temp\windowskeyfinder.exe
"C:\Users\Admin\AppData\Local\Temp\windowskeyfinder.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2936

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact