f481c6e155677e5c8f65bde2a5d32ec333a1ecac2908c107d541ad2f8c71a424

Analysis

max time kernel
148s
max time network
186s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 12:42

Target

f481c6e155677e5c8f65bde2a5d32ec333a1ecac2908c107d541ad2f8c71a424.exe
Size

836KB
MD5

458d114114d972cfa4a66644ac37fab4
SHA1

cc46ba8290e01749eb0ebb4be4e0f9ad1555df9d
SHA256

f481c6e155677e5c8f65bde2a5d32ec333a1ecac2908c107d541ad2f8c71a424
SHA512

fd369f0b07e2b14d11810f7098bd6d20053492b661aca7cc2c26ac1a9f12e7c12750894b972aaab04a928de286ca101a7546752a8adc7449de57ed17ea5f7f40
SSDEEP

12288:sNRTnf5e6U+qW+B3U3QSPhSHhPGqoPTIBymRzoN+Wh0F9FRUxwH/mbjv:sNBnf5lU/zWgyhYnoPEwSoMwxwfajv

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

f481c6e155677e5c8f65bde2a5d32ec333a1ecac2908c107d541ad2f8c71a424.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\AS2014 = "C:\\ProgramData\\nX7l9srv\\nX7l9srv.exe"	f481c6e155677e5c8f65bde2a5d32ec333a1ecac2908c107d541ad2f8c71a424.exe

C:\Users\Admin\AppData\Local\Temp\f481c6e155677e5c8f65bde2a5d32ec333a1ecac2908c107d541ad2f8c71a424.exe
"C:\Users\Admin\AppData\Local\Temp\f481c6e155677e5c8f65bde2a5d32ec333a1ecac2908c107d541ad2f8c71a424.exe"
1⤵
- Adds Run key to start application
PID:688

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/688-55-0x0000000000400000-0x00000000004D3000-memory.dmp

Filesize
844KB

Download
memory/688-56-0x0000000000400000-0x00000000004D3000-memory.dmp

Filesize
844KB

Download
memory/688-57-0x0000000000400000-0x00000000004D3000-memory.dmp

Filesize
844KB

Download
memory/688-54-0x0000000000400000-0x00000000004D3000-memory.dmp

Filesize
844KB

Download
memory/688-58-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download
memory/688-59-0x0000000001FD0000-0x00000000020A3000-memory.dmp

Filesize
844KB

Download
memory/688-60-0x0000000000400000-0x00000000004D3000-memory.dmp

Filesize
844KB

Download
memory/688-61-0x0000000000400000-0x00000000004D3000-memory.dmp

Filesize
844KB

Download