b0471a55b4f76bdac67acf88eaaed2335198732afbbb5e37adec4c4346cc1edf

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13/04/2023, 06:12

Target

sets.ps1
Size

512B
MD5

9f797334ceca4dbf0f9fde8bad8cdc24
SHA1

11b010e8282adca33fb0439e87230cb502eddffd
SHA256

b0471a55b4f76bdac67acf88eaaed2335198732afbbb5e37adec4c4346cc1edf
SHA512

65f6841951f95a2d98d79650dbb2de602215f8c904c5d2fb0d1f70665408b14fca6f8c32e9399f38f1b03d7df8669b43e55109a9b0b42c61750f1798b3d7c02a

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows\CurrentVersion\Run\ONEN0TEupdate = "C:\\Users\\Admin\\AppData\\Roaming\\ONEN0TEupdate\\client32.exe"	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1400	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1400	powershell.exe

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1400-58-0x000000001B220000-0x000000001B502000-memory.dmp

Filesize
2.9MB

Download
memory/1400-59-0x0000000001DF0000-0x0000000001DF8000-memory.dmp

Filesize
32KB

Download
memory/1400-60-0x0000000002670000-0x00000000026F0000-memory.dmp

Filesize
512KB

Download
memory/1400-61-0x0000000002670000-0x00000000026F0000-memory.dmp

Filesize
512KB

Download
memory/1400-62-0x0000000002670000-0x00000000026F0000-memory.dmp

Filesize
512KB

Download
memory/1400-63-0x0000000002670000-0x00000000026F0000-memory.dmp

Filesize
512KB

Download