5d3ead35ae560ba437312692a8ea79125fb275b5b2bedb32e1704942185dcff0

Analysis

max time kernel
189s
max time network
58s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d3ead35ae560ba437312692a8ea79125fb275b5b2bedb32e1704942185dcff0.exe
Size

107KB
MD5

96d87458de829cdb948f3dcc84dce850
SHA1

3043ae26d6b873b46ae4f47cc290e40202dbb922
SHA256

5d3ead35ae560ba437312692a8ea79125fb275b5b2bedb32e1704942185dcff0
SHA512

bac2e2e5c567c1393f176e04c4e7f0fe25c464395a413e7f5ea037f1e44e5465b4a321df581f693abbf4ac4bcafb777d5f2d4b8bd0e4f906d415ae0563f3ae72
SSDEEP

1536:NSjRtTkrNCgr0Zu0vShzYWmHtPtyHKOq9wmskMMMlZ8VGVe7ws/Y8WG:NYRkrHgZf6YfHtFyHKOq6VqVMe7ws/Y

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2004	vcflye.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\vcflye.exe	5d3ead35ae560ba437312692a8ea79125fb275b5b2bedb32e1704942185dcff0.exe
File opened for modification	C:\Windows\SysWOW64\vcflye.exe	5d3ead35ae560ba437312692a8ea79125fb275b5b2bedb32e1704942185dcff0.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vcflye.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	vcflye.exe

C:\Users\Admin\AppData\Local\Temp\5d3ead35ae560ba437312692a8ea79125fb275b5b2bedb32e1704942185dcff0.exe
"C:\Users\Admin\AppData\Local\Temp\5d3ead35ae560ba437312692a8ea79125fb275b5b2bedb32e1704942185dcff0.exe"
1⤵
- Drops file in System32 directory
PID:1564

C:\Windows\SysWOW64\vcflye.exe
C:\Windows\SysWOW64\vcflye.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\vcflye.exe

Filesize
107KB

MD5
96d87458de829cdb948f3dcc84dce850

SHA1
3043ae26d6b873b46ae4f47cc290e40202dbb922

SHA256
5d3ead35ae560ba437312692a8ea79125fb275b5b2bedb32e1704942185dcff0

SHA512
bac2e2e5c567c1393f176e04c4e7f0fe25c464395a413e7f5ea037f1e44e5465b4a321df581f693abbf4ac4bcafb777d5f2d4b8bd0e4f906d415ae0563f3ae72

Download Submit
memory/1564-54-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download