4b12a2bc615b85b7d086e6da4027f13eddc7c21ab1cd3ed8ef419500c52f0064

Analysis

max time kernel
172s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 16:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4b12a2bc615b85b7d086e6da4027f13eddc7c21ab1cd3ed8ef419500c52f0064.exe
Size

332KB
MD5

68f06fd21feabad3ba7825a3d37e0810
SHA1

2356ac92711eb7c8e51125f0b64cd73ad20aa1c1
SHA256

4b12a2bc615b85b7d086e6da4027f13eddc7c21ab1cd3ed8ef419500c52f0064
SHA512

ff55dbc970586a91647ab913b8853b8ad91d6634b324bb4affdaa0dddab764a546504d70d76f6d0f1ad8ce334dd63dc80d7f9b37b7a2fcb73644f97b239b0663
SSDEEP

6144:vrv3cKbUzkuvcBYC47l2xzjuWPS9uCYHmnP9lSbrlgsjDTFjjnXDwUr2PQc0:vrv3czkuveY3+I9uv+9lkpgoPFjrXDb

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
4964	4b12a2bc615b85b7d086e6da4027f13eddc7c21ab1cd3ed8ef419500c52f0064.exe
4964	4b12a2bc615b85b7d086e6da4027f13eddc7c21ab1cd3ed8ef419500c52f0064.exe
4964	4b12a2bc615b85b7d086e6da4027f13eddc7c21ab1cd3ed8ef419500c52f0064.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	4b12a2bc615b85b7d086e6da4027f13eddc7c21ab1cd3ed8ef419500c52f0064.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	4b12a2bc615b85b7d086e6da4027f13eddc7c21ab1cd3ed8ef419500c52f0064.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4964	4b12a2bc615b85b7d086e6da4027f13eddc7c21ab1cd3ed8ef419500c52f0064.exe
4964	4b12a2bc615b85b7d086e6da4027f13eddc7c21ab1cd3ed8ef419500c52f0064.exe

C:\Users\Admin\AppData\Local\Temp\4b12a2bc615b85b7d086e6da4027f13eddc7c21ab1cd3ed8ef419500c52f0064.exe
"C:\Users\Admin\AppData\Local\Temp\4b12a2bc615b85b7d086e6da4027f13eddc7c21ab1cd3ed8ef419500c52f0064.exe"
1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:4964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TsuEA7E62E5.dll

Filesize
269KB

MD5
af7ce801c8471c5cd19b366333c153c4

SHA1
4267749d020a362edbd25434ad65f98b073581f1

SHA256
cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

SHA512
88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

Download Submit
C:\Users\Admin\AppData\Local\Temp\{5277E872-BB7A-4149-A3A2-F3588994CA84}\Custom.dll

Filesize
91KB

MD5
71ffb31fe40a3f10913982ee89fa764c

SHA1
c17fa19479a7559f666a30d2932a2b9d540bd0ee

SHA256
b0e3f473796f639cab1354971740405bc39a096839ac53b4dfaae2c4acb71599

SHA512
6913a278fa38b9cef7b317ed7eab7773447dbc786d60531455c5cb28d82c677b472f2c50b3b9e1a8a71290757f064c828721633fb5f7bef47897dc740b1567ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\{5277E872-BB7A-4149-A3A2-F3588994CA84}\_Setup.dll

Filesize
180KB

MD5
ddcd2c95d6c9c6fdca7b9d8a30019bf9

SHA1
4bf222ee818a36e9efaaade3f9302fa0cf3ba18b

SHA256
4157ccb1c8d9b32c8d7928479289d42aeb2e0660a1c2135053515e8bfe24f61b

SHA512
93fa771993b0bf313b2ec00b73fdbb78f02529446407d17c22b8e5805e0eaf156a141706de2538a57d5d6ba8a3605f96e6c8f1e230dcd811ccf184e50b633f11

Download Submit