bca43810908cd233f285ca07aa92c246f0e8b9b303661debed245db97d52593e

Analysis

max time kernel
142s
max time network
142s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 05:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bca43810908cd233f285ca07aa92c246f0e8b9b303661debed245db97d52593e.exe
Size

332KB
MD5

81155ca49b04add3f6130717af7d7bd0
SHA1

109463b8bfb7686cf1ea08e25ab03b5d838aacb8
SHA256

bca43810908cd233f285ca07aa92c246f0e8b9b303661debed245db97d52593e
SHA512

2399ebf47fbab24154223c3679bad55b8ca7fd658b25360e3b40ca2e000780a5e1ab7f1f5145b77b672721d3180286ebc2c71b01d5dcc8de599401470603185d
SSDEEP

6144:3rv3cKbUzkuvcBYC47l2xzjuWPS9uCYHmnP9lSbrlgsjDTFjjnXDwUr2PQci:3rv3czkuveY3+I9uv+9lkpgoPFjrXDF

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2000	bca43810908cd233f285ca07aa92c246f0e8b9b303661debed245db97d52593e.exe
2000	bca43810908cd233f285ca07aa92c246f0e8b9b303661debed245db97d52593e.exe
2000	bca43810908cd233f285ca07aa92c246f0e8b9b303661debed245db97d52593e.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	bca43810908cd233f285ca07aa92c246f0e8b9b303661debed245db97d52593e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	bca43810908cd233f285ca07aa92c246f0e8b9b303661debed245db97d52593e.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2000	bca43810908cd233f285ca07aa92c246f0e8b9b303661debed245db97d52593e.exe

C:\Users\Admin\AppData\Local\Temp\bca43810908cd233f285ca07aa92c246f0e8b9b303661debed245db97d52593e.exe
"C:\Users\Admin\AppData\Local\Temp\bca43810908cd233f285ca07aa92c246f0e8b9b303661debed245db97d52593e.exe"
1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:2000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\TsuC51FEE34.dll

Filesize
269KB

MD5
af7ce801c8471c5cd19b366333c153c4

SHA1
4267749d020a362edbd25434ad65f98b073581f1

SHA256
cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

SHA512
88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

Download Submit
\Users\Admin\AppData\Local\Temp\{1EEA999C-BC46-419D-A376-F464C509BB6A}\Custom.dll

Filesize
91KB

MD5
71ffb31fe40a3f10913982ee89fa764c

SHA1
c17fa19479a7559f666a30d2932a2b9d540bd0ee

SHA256
b0e3f473796f639cab1354971740405bc39a096839ac53b4dfaae2c4acb71599

SHA512
6913a278fa38b9cef7b317ed7eab7773447dbc786d60531455c5cb28d82c677b472f2c50b3b9e1a8a71290757f064c828721633fb5f7bef47897dc740b1567ab

Download Submit
\Users\Admin\AppData\Local\Temp\{1EEA999C-BC46-419D-A376-F464C509BB6A}\_Setup.dll

Filesize
180KB

MD5
ddcd2c95d6c9c6fdca7b9d8a30019bf9

SHA1
4bf222ee818a36e9efaaade3f9302fa0cf3ba18b

SHA256
4157ccb1c8d9b32c8d7928479289d42aeb2e0660a1c2135053515e8bfe24f61b

SHA512
93fa771993b0bf313b2ec00b73fdbb78f02529446407d17c22b8e5805e0eaf156a141706de2538a57d5d6ba8a3605f96e6c8f1e230dcd811ccf184e50b633f11

Download Submit
memory/2000-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download