2230f46d18d3702f24f1293c19ff977ada562cfc2fe64e9a39b41545e48d097a

Analysis

max time kernel
152s
max time network
161s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:55

Target

2230f46d18d3702f24f1293c19ff977ada562cfc2fe64e9a39b41545e48d097a.exe
Size

806KB
MD5

a05b067e41e72399bd83c0229a181584
SHA1

8ceed66e7458ec4c0d067a8f1934d0dd2bf3bcfa
SHA256

2230f46d18d3702f24f1293c19ff977ada562cfc2fe64e9a39b41545e48d097a
SHA512

758a536680e2c0de23eb2a362d957bae813f961c461ee0166f4c9798e76ad3280b1822ea8430ca66082f6f7c0e8df257f921b8812934b6d8cfc75d3c11731bd8
SSDEEP

12288:+VztmVedHczyWjy0rZXJeyuY+gSZSLyScxKYao49FreXSrg3fEFfP:+VcVedWy2y0rvepYKZhBxKKC6if

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

2230f46d18d3702f24f1293c19ff977ada562cfc2fe64e9a39b41545e48d097a.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\AS2014 = "C:\\ProgramData\\aDs6UUR7\\aDs6UUR7.exe"	2230f46d18d3702f24f1293c19ff977ada562cfc2fe64e9a39b41545e48d097a.exe

C:\Users\Admin\AppData\Local\Temp\2230f46d18d3702f24f1293c19ff977ada562cfc2fe64e9a39b41545e48d097a.exe
"C:\Users\Admin\AppData\Local\Temp\2230f46d18d3702f24f1293c19ff977ada562cfc2fe64e9a39b41545e48d097a.exe"
1⤵
- Adds Run key to start application
PID:1928

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1928-54-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/1928-57-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/1928-56-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/1928-55-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/1928-58-0x0000000001D10000-0x0000000001DDB000-memory.dmp

Filesize
812KB

Download
memory/1928-59-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/1928-60-0x00000000762B1000-0x00000000762B3000-memory.dmp

Filesize
8KB

Download
memory/1928-61-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download