7bfc7ede765e35aa1e9e5b7b4aca09d070b9ac5f7d013908e4c65b831ce61f88

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
13-01-2023 21:41

Target

7bfc7ede765e35aa1e9e5b7b4aca09d070b9ac5f7d013908e4c65b831ce61f88.exe
Size

3.4MB
MD5

237468f7285bf6a662fdba3a37f9942c
SHA1

f5a99ecd7847cc79210d5df505e222828ad63199
SHA256

7bfc7ede765e35aa1e9e5b7b4aca09d070b9ac5f7d013908e4c65b831ce61f88
SHA512

ba05b1532df9e8718696976b390ad3b7cb82d45faa1a1caabb6ab06b27ec3bd3e046076ff04935d985e9666825ede8ff797f4c1e3ee41d114307fbaa498c6c31
SSDEEP

49152:YCRkAxXmLEjZxiRjd1SE961RPjXIC0l7cp0EBvHbZzxTG8yEOWnPd4Y:YL0ASRPjXeWpXBvHbZzDO4Pd4

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

7bfc7ede765e35aa1e9e5b7b4aca09d070b9ac5f7d013908e4c65b831ce61f88.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\AMDGO = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7bfc7ede765e35aa1e9e5b7b4aca09d070b9ac5f7d013908e4c65b831ce61f88.exe"	7bfc7ede765e35aa1e9e5b7b4aca09d070b9ac5f7d013908e4c65b831ce61f88.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

7bfc7ede765e35aa1e9e5b7b4aca09d070b9ac5f7d013908e4c65b831ce61f88.exe

pid process

1584 7bfc7ede765e35aa1e9e5b7b4aca09d070b9ac5f7d013908e4c65b831ce61f88.exe

pid	process
1584	7bfc7ede765e35aa1e9e5b7b4aca09d070b9ac5f7d013908e4c65b831ce61f88.exe

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1584-54-0x0000000075241000-0x0000000075243000-memory.dmp

Filesize
8KB

Download