9846468411030ea5c48b38ffb0198eaa4f2bed5a817c5eaf84af218d7a4503b1

Analysis

Target

9846468411030ea5c48b38ffb0198eaa4f2bed5a817c5eaf84af218d7a4503b1.exe
Size

6KB
MD5

c3bf0df582ff79a82535f5c5ecd488c1
SHA1

b0b01f05133c1b2b23994ea645e99e907172f269
SHA256

9846468411030ea5c48b38ffb0198eaa4f2bed5a817c5eaf84af218d7a4503b1
SHA512

6315b873f1c00776c4ef253849295c12cd5dffd958a1e879b66ed4d441e821416e6aadb17515c207333bd039db98f0a5354d777d678568dfff3aaf37a4090e9a

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

9846468411030ea5c48b38ffb0198eaa4f2bed5a817c5eaf84af218d7a4503b1.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mstss = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9846468411030ea5c48b38ffb0198eaa4f2bed5a817c5eaf84af218d7a4503b1.exe"	9846468411030ea5c48b38ffb0198eaa4f2bed5a817c5eaf84af218d7a4503b1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	9846468411030ea5c48b38ffb0198eaa4f2bed5a817c5eaf84af218d7a4503b1.exe

C:\Users\Admin\AppData\Local\Temp\9846468411030ea5c48b38ffb0198eaa4f2bed5a817c5eaf84af218d7a4503b1.exe
"C:\Users\Admin\AppData\Local\Temp\9846468411030ea5c48b38ffb0198eaa4f2bed5a817c5eaf84af218d7a4503b1.exe"
1⤵
- Adds Run key to start application
PID:1784

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/1784-54-0x0000000074C81000-0x0000000074C83000-memory.dmp

Filesize
8KB

Download