7111a52b46eb110d212a6d259a800bd767f708f93856715e619bd3005456c6e7

Analysis

max time kernel
237s
max time network
332s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:48

Target

7111a52b46eb110d212a6d259a800bd767f708f93856715e619bd3005456c6e7.exe
Size

389KB
MD5

92191c23f5e1137c7acf7aa27cdb3fca
SHA1

a5008b9413ccc1a1be11ab8fa657f9955b882d11
SHA256

7111a52b46eb110d212a6d259a800bd767f708f93856715e619bd3005456c6e7
SHA512

a8688e1bb703ff2c5fbeee07c60316d73989cd6138961f28a250b860be01ef87e5b0ed3017f68635bb5643ea4eb16bd646f2287e09cc45787c2930edfe7a51f4
SSDEEP

6144:+75ozYoibG9J12+YLXryKoaWJBQb13rgQDu3tgVGLAM46ldsRVwuVvUk8F90wunA:WWYUJ1WsBY9gQys2Axvw0m

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 4 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

7111a52b46eb110d212a6d259a800bd767f708f93856715e619bd3005456c6e7.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7111a52b46eb110d212a6d259a800bd767f708f93856715e619bd3005456c6e7.exe"	7111a52b46eb110d212a6d259a800bd767f708f93856715e619bd3005456c6e7.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	7111a52b46eb110d212a6d259a800bd767f708f93856715e619bd3005456c6e7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7111a52b46eb110d212a6d259a800bd767f708f93856715e619bd3005456c6e7.exe"	7111a52b46eb110d212a6d259a800bd767f708f93856715e619bd3005456c6e7.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run	7111a52b46eb110d212a6d259a800bd767f708f93856715e619bd3005456c6e7.exe

C:\Users\Admin\AppData\Local\Temp\7111a52b46eb110d212a6d259a800bd767f708f93856715e619bd3005456c6e7.exe
"C:\Users\Admin\AppData\Local\Temp\7111a52b46eb110d212a6d259a800bd767f708f93856715e619bd3005456c6e7.exe"
1⤵
- Adds Run key to start application
PID:672

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/672-54-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download