38bad4c27f4c9ff8744c6fd44d66b97fd73feacafb6c2b924308ba0c92ae1172

Analysis

max time kernel
144s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 03:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
38bad4c27f4c9ff8744c6fd44d66b97fd73feacafb6c2b924308ba0c92ae1172.exe
Size 325KB
Sample221011-d4w8pacgd3
SHA256 38bad4c27f4c9ff8744c6fd44d66b97fd73feacafb6c2b924308ba0c92ae1172
MD5 6886f6bda6561229548003909f00a340
SHA1 86decb00a47c47b307db213550ced775227eb708
SHA512 f5cbc89b251ba2a2e0e73d9a8eea09fe39e340bc91ad476309a4764faa6d6caca5b156015d81c84b320e792af7569660c61a8c25b39093a3a75bfdc4443e52c4
SSDEEP 6144:lr1Bh9uEo2S1YnQmCX492DkwNP3qpYFDcYgQUskKWeFCEQOiCYOqmO5oR:lr1B3u6/eIo4ArVUBQCCYOqmO5oR
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
3016	38bad4c27f4c9ff8744c6fd44d66b97fd73feacafb6c2b924308ba0c92ae1172.exe
3016	38bad4c27f4c9ff8744c6fd44d66b97fd73feacafb6c2b924308ba0c92ae1172.exe
3016	38bad4c27f4c9ff8744c6fd44d66b97fd73feacafb6c2b924308ba0c92ae1172.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	38bad4c27f4c9ff8744c6fd44d66b97fd73feacafb6c2b924308ba0c92ae1172.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	38bad4c27f4c9ff8744c6fd44d66b97fd73feacafb6c2b924308ba0c92ae1172.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3016	38bad4c27f4c9ff8744c6fd44d66b97fd73feacafb6c2b924308ba0c92ae1172.exe
3016	38bad4c27f4c9ff8744c6fd44d66b97fd73feacafb6c2b924308ba0c92ae1172.exe

C:\Users\Admin\AppData\Local\Temp\38bad4c27f4c9ff8744c6fd44d66b97fd73feacafb6c2b924308ba0c92ae1172.exe
"C:\Users\Admin\AppData\Local\Temp\38bad4c27f4c9ff8744c6fd44d66b97fd73feacafb6c2b924308ba0c92ae1172.exe"
1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:3016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TsuBAFFB501.dll

Path C:\Users\Admin\AppData\Local\Temp\TsuBAFFB501.dll
Size 269KB
SHA256 cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e
MD5 af7ce801c8471c5cd19b366333c153c4
SHA1 4267749d020a362edbd25434ad65f98b073581f1
SHA512 88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c
SSDEEP 6144:N/rdStrfAftBVju6v+UvrBhMo27dOQnyddk:J3y6vHvrBhLYjnydC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Custom.dll

Path C:\Users\Admin\AppData\Local\Temp\{71C4E545-1B16-4A65-A88E-5334AA27C7B3}\Custom.dll
Size 91KB
SHA256 54346f2e36bdb512ef4f7d702f18e59a746f0b936786bc76a30e87de0a061f17
MD5 736682c6d96bb1edc84e77041faae33d
SHA1 f8f6e20cd2aa23010b85ea289c3bc3cbdbc9ae26
SHA512 fe24353f0f4acafbde7d8cec7a5078668f5e6cd0b06c3e0c96cb3fed0beb3c8af2becb1d97fcbb369ac38193827c8d8a440694c79b5da3180224377e38f53777
SSDEEP 1536:K7xcx/juCKV+hVboYrEhySESy9GNGU6u1Go6eOYM++vvncDoU:K7qxa8NoYr6w5S8o6epM++v/cDr
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Setup.dll

Path C:\Users\Admin\AppData\Local\Temp\{71C4E545-1B16-4A65-A88E-5334AA27C7B3}\_Setup.dll
Size 180KB
SHA256 2cd6c67a711059c2245615d80ee0e7d44a003b66d5577513b1dfb1bd7f1e7312
MD5 a475792794328d8a503568cbe38e8531
SHA1 47e5c4857f272898ed515e939f92cb9243b2ce2e
SHA512 3ea14ace569233dd69e730b4dfae4f1292d2e950aa26aceeae78715d0831ff6919d1bbf7c70ec256dd8a5db7f2d09ea4f29a564c125b54fdf8c7de2c78631184
SSDEEP 3072:mzLBt+S4cNJtkAlRHAAMHnS9qkJUsCmBW/fpICcsRuUwZxcUdONKnNPZv8FK4Us3:mPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download