b03583722911a44f38d15a947b73598f3d649d39e10671bbbae3430ba8bcbc33

Analysis

max time kernel
173s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:58

Target

b03583722911a44f38d15a947b73598f3d649d39e10671bbbae3430ba8bcbc33.exe
Size

2.9MB
MD5

e3ab4d977f346c1eeb7876acc45c77eb
SHA1

32eeaaa7121a5ae2c1f543b7c6caedb69b993066
SHA256

b03583722911a44f38d15a947b73598f3d649d39e10671bbbae3430ba8bcbc33
SHA512

f00350728bad9b351554a84dfbff1764eb34192d74bf8e140a226cb26b49b99151f5ece7a8f3a9a2b9056a4fc0c861c09e9f234fcac528c2b570be5f92d64207
SSDEEP

49152:U9ATJ8gPxb70GduE8mnjIgzQ6j2v/Mz6XNQ/FS0L6/N4bTIANdaFWRX9o:U9WJ8gV7jB8GIgzQHa6XNco4bTnN3V6

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

b03583722911a44f38d15a947b73598f3d649d39e10671bbbae3430ba8bcbc33.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsMicrosoft = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b03583722911a44f38d15a947b73598f3d649d39e10671bbbae3430ba8bcbc33.exe"	b03583722911a44f38d15a947b73598f3d649d39e10671bbbae3430ba8bcbc33.exe

C:\Users\Admin\AppData\Local\Temp\b03583722911a44f38d15a947b73598f3d649d39e10671bbbae3430ba8bcbc33.exe
"C:\Users\Admin\AppData\Local\Temp\b03583722911a44f38d15a947b73598f3d649d39e10671bbbae3430ba8bcbc33.exe"
1⤵
- Adds Run key to start application
PID:4668

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/4668-132-0x0000000000400000-0x0000000000E75000-memory.dmp

Filesize
10.5MB

Download
memory/4668-133-0x0000000000400000-0x0000000000E75000-memory.dmp

Filesize
10.5MB

Download
memory/4668-134-0x0000000000400000-0x0000000000E75000-memory.dmp

Filesize
10.5MB

Download