25b681053e3e6066bde65122d92e936212751b6ea6d7d8a307524e0d23ceb2e3

Analysis

Target

Solicitud de pago.exe
Size

1.1MB
MD5

5fd07e200ebbcf5b0f993d124a52cb91
SHA1

d83a1efffdca541142d8ef07768aadb59168ef70
SHA256

15e832cfe4bca263c941f26d1da9bfdac36340a2ee29ad62cd0c7cb5037b0b6d
SHA512

9c2237779a8b01f94016815b21ea1ee8197f43de358dd8c65766320b2b3e52120c0c263434366baefddac5373d271a0bcbe4195022b3f9e5a0638d3d864dd392

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

Solicitud de pago.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\None = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\None"	Solicitud de pago.exe

C:\Users\Admin\AppData\Local\Temp\Solicitud de pago.exe
"C:\Users\Admin\AppData\Local\Temp\Solicitud de pago.exe"
1⤵
- Adds Run key to start application
PID:1196

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1196-130-0x0000000000810000-0x0000000000932000-memory.dmp

Filesize
1.1MB

Download