f65114752b166174b94ea0ade20b09330f10f79a1d8f3c9106f7ea03075d26a5

Analysis

Target

f65114752b166174b94ea0ade20b09330f10f79a1d8f3c9106f7ea03075d26a5.exe
Size

476KB
MD5

0cf86ddb6e5ca2ae5be3c74de69ab646
SHA1

227135aa5a53d53b044d19102cf91263f8317e02
SHA256

f65114752b166174b94ea0ade20b09330f10f79a1d8f3c9106f7ea03075d26a5
SHA512

6cb714e80b4e7d2e5c3bf227a1a92e0e275ed3e2e593efe94d7222e2cc73f2217c67edc4517a8dddf6ecf8b2737a57725fb8c8b73bca56e5f585fb11371c3b0d

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

f65114752b166174b94ea0ade20b09330f10f79a1d8f3c9106f7ea03075d26a5.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\f65114752b166174b94ea0ade20b09330f10f79a1d8f3c9106f7ea03075d26a5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f65114752b166174b94ea0ade20b09330f10f79a1d8f3c9106f7ea03075d26a5.exe"	f65114752b166174b94ea0ade20b09330f10f79a1d8f3c9106f7ea03075d26a5.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	f65114752b166174b94ea0ade20b09330f10f79a1d8f3c9106f7ea03075d26a5.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

f65114752b166174b94ea0ade20b09330f10f79a1d8f3c9106f7ea03075d26a5.exe

pid process

1576 f65114752b166174b94ea0ade20b09330f10f79a1d8f3c9106f7ea03075d26a5.exe

pid	process
1576	f65114752b166174b94ea0ade20b09330f10f79a1d8f3c9106f7ea03075d26a5.exe

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1576-53-0x0000000076451000-0x0000000076453000-memory.dmp

Filesize
8KB

Download
memory/1576-54-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download