3af52fc6b98be44421036133663c29d33529f19766b58196ebd794f6535f6666

Analysis

Target

3af52fc6b98be44421036133663c29d33529f19766b58196ebd794f6535f6666.exe
Size

185KB
MD5

d70dfcaeaa0b22ff35d6aa4ac5cc3d73
SHA1

ad878deb572598b742b585b4c5a19cfe938ceb1d
SHA256

3af52fc6b98be44421036133663c29d33529f19766b58196ebd794f6535f6666
SHA512

696dede73967ebad6a425faa4e701612db4f9e4d7c4458a15ff296d5ccab03687e7542aeb2979df8adb836681eef053cb18ee802d95aca4773909f90f7f32923

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

3af52fc6b98be44421036133663c29d33529f19766b58196ebd794f6535f6666.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6AE7990DC39D = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3af52fc6b98be44421036133663c29d33529f19766b58196ebd794f6535f6666.exe"	3af52fc6b98be44421036133663c29d33529f19766b58196ebd794f6535f6666.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	3af52fc6b98be44421036133663c29d33529f19766b58196ebd794f6535f6666.exe

C:\Users\Admin\AppData\Local\Temp\3af52fc6b98be44421036133663c29d33529f19766b58196ebd794f6535f6666.exe
"C:\Users\Admin\AppData\Local\Temp\3af52fc6b98be44421036133663c29d33529f19766b58196ebd794f6535f6666.exe"
1⤵
- Adds Run key to start application
PID:1228

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/1228-54-0x00000000751C1000-0x00000000751C3000-memory.dmp

Filesize
8KB

Download
memory/1228-55-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1228-56-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1228-58-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1228-57-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1228-59-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1228-61-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1228-62-0x00000000008D0000-0x000000000093B000-memory.dmp

Filesize
428KB

Download
memory/1228-63-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download