d28e054e699c8117f01c22dc5d5698e0a0c9e9001ee41e2b59aeb69f05a57b8d

Analysis

max time kernel
136s
max time network
150s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:55

Target

d28e054e699c8117f01c22dc5d5698e0a0c9e9001ee41e2b59aeb69f05a57b8d.exe
Size

762KB
MD5

3697ec9b9e73cd9c420385b660367473
SHA1

566e6e8bb7fcda1aaf8d6eceab95aeff4490d465
SHA256

d28e054e699c8117f01c22dc5d5698e0a0c9e9001ee41e2b59aeb69f05a57b8d
SHA512

ceea6e16eda147fc03e3e7a5c21a3be5b34fbd241cc22c87a2efd97c21cbd18c772a8101383e1ab0af931144ffb1eb715fb066d0d6bca456645af4d17690cfc4
SSDEEP

12288:UIymmaXrn/NKSpDmKRiNv+v4XwQTRMS9LnHwfTAOzHpphEeTK3ajIK/1h:UXI/NKS51TvUNTuSRn5a/hJ2qII

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

d28e054e699c8117f01c22dc5d5698e0a0c9e9001ee41e2b59aeb69f05a57b8d.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\AS2014 = "C:\\ProgramData\\6DsrrVVp\\6DsrrVVp.exe"	d28e054e699c8117f01c22dc5d5698e0a0c9e9001ee41e2b59aeb69f05a57b8d.exe

C:\Users\Admin\AppData\Local\Temp\d28e054e699c8117f01c22dc5d5698e0a0c9e9001ee41e2b59aeb69f05a57b8d.exe
"C:\Users\Admin\AppData\Local\Temp\d28e054e699c8117f01c22dc5d5698e0a0c9e9001ee41e2b59aeb69f05a57b8d.exe"
1⤵
- Adds Run key to start application
PID:1848

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1848-54-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1848-55-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1848-56-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1848-57-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1848-58-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download