3cf000dc4a4a2c5f0d28fb318e5c02470206fc7a3cbb8201f1c8d97a3c546143

Analysis

Target

3cf000dc4a4a2c5f0d28fb318e5c02470206fc7a3cbb8201f1c8d97a3c546143.exe
Size

185KB
MD5

fba0affdc9a1594ca28207842ad73fc4
SHA1

c62c139f02bfbae17b7bde1a367342012f7d9fc1
SHA256

3cf000dc4a4a2c5f0d28fb318e5c02470206fc7a3cbb8201f1c8d97a3c546143
SHA512

0434a0abee3eedc470f82fa73fe4b4cdc150e87de9dd9e0a58809eb90ac1f802c23eb8fdd24d34fcd57bee5dfbd73789947c49adb5a8c0175f0349f87a7cbf1a

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

3cf000dc4a4a2c5f0d28fb318e5c02470206fc7a3cbb8201f1c8d97a3c546143.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	3cf000dc4a4a2c5f0d28fb318e5c02470206fc7a3cbb8201f1c8d97a3c546143.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6AE9FCDE30C7 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3cf000dc4a4a2c5f0d28fb318e5c02470206fc7a3cbb8201f1c8d97a3c546143.exe"	3cf000dc4a4a2c5f0d28fb318e5c02470206fc7a3cbb8201f1c8d97a3c546143.exe

C:\Users\Admin\AppData\Local\Temp\3cf000dc4a4a2c5f0d28fb318e5c02470206fc7a3cbb8201f1c8d97a3c546143.exe
"C:\Users\Admin\AppData\Local\Temp\3cf000dc4a4a2c5f0d28fb318e5c02470206fc7a3cbb8201f1c8d97a3c546143.exe"
1⤵
- Adds Run key to start application
PID:1984

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/1984-54-0x00000000756E1000-0x00000000756E3000-memory.dmp

Filesize
8KB

Download
memory/1984-55-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1984-59-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1984-58-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1984-57-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1984-56-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1984-60-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1984-62-0x0000000000230000-0x000000000029B000-memory.dmp

Filesize
428KB

Download
memory/1984-63-0x0000000000230000-0x000000000029B000-memory.dmp

Filesize
428KB

Download
memory/1984-64-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1984-65-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download