56243bb09bc9c59ec8aaa5cfa6af5742606fdd80513160f7ef48902973e74812

Analysis

Target

BALANCE PAYMENT OF INV #005788903736282 20200418.exe
Size

798KB
MD5

f3e15133475c60bee93e6070cd10e225
SHA1

a032ad2d8e73a9518a7b3ed576463651439e42a9
SHA256

4baf908e1965d8126d27be6eda11a4153c94ac0350e4d4856af65c60af4dfdcd
SHA512

15d1ecf626338579b3df6ca33dc1db60f43f7d133a9ed2a5f3668ee00b7ee2a98857567bb6b6c95a9ac65d83c7e99afb052a0c5a180c36154a1d95e7e70a20b5

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

BALANCE PAYMENT OF INV #005788903736282 20200418.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\None = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\None"	BALANCE PAYMENT OF INV #005788903736282 20200418.exe

C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
"C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
1⤵
- Adds Run key to start application
PID:4988

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/4988-130-0x0000000000C40000-0x0000000000D0E000-memory.dmp

Filesize
824KB

Download