be94ce582b959c8449ce618d1e09b63293b9e4aad5c76e51aeba60d380074f2a

Analysis

max time kernel
146s
max time network
185s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:13

Target

be94ce582b959c8449ce618d1e09b63293b9e4aad5c76e51aeba60d380074f2a.exe
Size

818KB
MD5

b8e717327e0f0e856eb8b8eb1e6e3a21
SHA1

3ddbde4fef9b4dec31b5c3a2d6839082df95b8f9
SHA256

be94ce582b959c8449ce618d1e09b63293b9e4aad5c76e51aeba60d380074f2a
SHA512

bcceb5c411c64eac1e1a5fc0e236bfeaffa82e1f4277c0f3d9a666f59278a4d6dcc720377d5e64d98fbebbee1f433b18bdedbd047ab948b3b31dbbd030817f00
SSDEEP

12288:cJV4aQVSfVC5GEafUx/bSoSGNvpULlvHZMfV3kNfb5D71+mXPK0DSBmGP:cwUf2ReGbSoSGppULIdkNfp1+ki0DI

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

be94ce582b959c8449ce618d1e09b63293b9e4aad5c76e51aeba60d380074f2a.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\AS2014 = "C:\\ProgramData\\i9VVig6x\\i9VVig6x.exe"	be94ce582b959c8449ce618d1e09b63293b9e4aad5c76e51aeba60d380074f2a.exe

C:\Users\Admin\AppData\Local\Temp\be94ce582b959c8449ce618d1e09b63293b9e4aad5c76e51aeba60d380074f2a.exe
"C:\Users\Admin\AppData\Local\Temp\be94ce582b959c8449ce618d1e09b63293b9e4aad5c76e51aeba60d380074f2a.exe"
1⤵
- Adds Run key to start application
PID:1992

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1992-54-0x00000000753D1000-0x00000000753D3000-memory.dmp

Filesize
8KB

Download
memory/1992-55-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download
memory/1992-57-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download
memory/1992-56-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download
memory/1992-58-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download