6690c39fd6b050fd5fb049e9641235b83cb9a83f2e37188c6027d6e88ea1038e

Analysis

max time kernel
146s
max time network
161s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 14:06

Target

6690c39fd6b050fd5fb049e9641235b83cb9a83f2e37188c6027d6e88ea1038e.exe
Size

776KB
MD5

dc16d00125e47d401f82269657769802
SHA1

d680ead818bb1e725324e749ff7d72a782fc7220
SHA256

6690c39fd6b050fd5fb049e9641235b83cb9a83f2e37188c6027d6e88ea1038e
SHA512

751cc01fb8ac277dec474b7c8f81711ba4062514dc61614aceb488b21fc2a3bb805fd409b4e00b9bf91c48cbe418987c52be1bc08e70f72f39d6290dae49c670
SSDEEP

24576:TXWfdwxNPYOL0JmBn14gpy13bffKE6Bpx0rHL:zWfdwbYmCmB14gpofC

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

6690c39fd6b050fd5fb049e9641235b83cb9a83f2e37188c6027d6e88ea1038e.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\AS2014 = "C:\\ProgramData\\RpD333lD\\RpD333lD.exe"	6690c39fd6b050fd5fb049e9641235b83cb9a83f2e37188c6027d6e88ea1038e.exe

C:\Users\Admin\AppData\Local\Temp\6690c39fd6b050fd5fb049e9641235b83cb9a83f2e37188c6027d6e88ea1038e.exe
"C:\Users\Admin\AppData\Local\Temp\6690c39fd6b050fd5fb049e9641235b83cb9a83f2e37188c6027d6e88ea1038e.exe"
1⤵
- Adds Run key to start application
PID:1168

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1168-54-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/1168-55-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/1168-56-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/1168-57-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/1168-58-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download