44c8df6d14fa0a8cde32575f625c685e629a401ff0e1053b98bbbd9b20f77473

Analysis

max time kernel
172s
max time network
192s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:55

Target

44c8df6d14fa0a8cde32575f625c685e629a401ff0e1053b98bbbd9b20f77473.exe
Size

806KB
MD5

9f0f4e99708297d8a70c0f1e544d9ab9
SHA1

7023db895922c008ce1766ea5da541f59538bf8b
SHA256

44c8df6d14fa0a8cde32575f625c685e629a401ff0e1053b98bbbd9b20f77473
SHA512

129344c488a7e3fee96396ca879ef107142d9021fb59cc3ee1b70c9b3013c7da9b5557e690136288b168419632f8662b0316f58ea4cf5c786bec14253f718e14
SSDEEP

12288:+VztmVedHczyWjy0rZXJeyuY+gSZSLyScxKYao49FreXSrg3fEFfP:+VcVedWy2y0rvepYKZhBxKKC6if

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

44c8df6d14fa0a8cde32575f625c685e629a401ff0e1053b98bbbd9b20f77473.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\AS2014 = "C:\\ProgramData\\i9VVig6x\\i9VVig6x.exe"	44c8df6d14fa0a8cde32575f625c685e629a401ff0e1053b98bbbd9b20f77473.exe

C:\Users\Admin\AppData\Local\Temp\44c8df6d14fa0a8cde32575f625c685e629a401ff0e1053b98bbbd9b20f77473.exe
"C:\Users\Admin\AppData\Local\Temp\44c8df6d14fa0a8cde32575f625c685e629a401ff0e1053b98bbbd9b20f77473.exe"
1⤵
- Adds Run key to start application
PID:1004

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1004-54-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/1004-55-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/1004-56-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/1004-57-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/1004-58-0x0000000075881000-0x0000000075883000-memory.dmp

Filesize
8KB

Download
memory/1004-59-0x0000000000330000-0x00000000003FB000-memory.dmp

Filesize
812KB

Download
memory/1004-60-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/1004-61-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download