8aca0a46ba2844ddd4ae72746c1781f81f23a326ebb150ffb2ae511d10112c31

Analysis

max time kernel
6s
max time network
168s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-10-2022 22:18

Target

8aca0a46ba2844ddd4ae72746c1781f81f23a326ebb150ffb2ae511d10112c31.exe
Size

316KB
MD5

0b33271185b881f5af21836535e86400
SHA1

f73e610b3596b64611b7a8eb03b57436da9da957
SHA256

8aca0a46ba2844ddd4ae72746c1781f81f23a326ebb150ffb2ae511d10112c31
SHA512

e42fdaf3dcec3897b31cce5386292ce4908cfc678c15bc1ee7c9d407aa5fb6b7da92ad756c2c02acf1b30a0bd652ced170db57b6d0504a396be5d22606f15138
SSDEEP

6144:Or+bUzkuvcBYC47l2xUa0nvmas+8gGxvzbLxS8YXsypuewKmik:OrXkuveY3z+U83tbLpmsgh/k

Score

7^/10

discovery

Loads dropped DLL 3 IoCs

pid	Process
1452	8aca0a46ba2844ddd4ae72746c1781f81f23a326ebb150ffb2ae511d10112c31.exe
1452	8aca0a46ba2844ddd4ae72746c1781f81f23a326ebb150ffb2ae511d10112c31.exe
1452	8aca0a46ba2844ddd4ae72746c1781f81f23a326ebb150ffb2ae511d10112c31.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8aca0a46ba2844ddd4ae72746c1781f81f23a326ebb150ffb2ae511d10112c31.exe
"C:\Users\Admin\AppData\Local\Temp\8aca0a46ba2844ddd4ae72746c1781f81f23a326ebb150ffb2ae511d10112c31.exe"
1⤵
- Loads dropped DLL
PID:1452

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\Tsu3A0918B0.dll

Filesize
49KB

MD5
ef8d96d68a2d07bb443519d69d950840

SHA1
3ba329a79b7ff47ca004e236575be05057ce9ad9

SHA256
19ec374368fb9e94eb8604cf6cd5bdfbc8921d0a7a79ac6c3da87e9482ef8ac8

SHA512
e333ab4713b41d3d93ba902f3189506ba2369389f0d5474cc2ee03166ec4b3c52b757e6c5f32a1982a473321e936bd822ec90b2eca9e5f4688eaa63e49a4bd4e

Download Submit
\Users\Admin\AppData\Local\Temp\{186A6170-007D-4F0E-ADE5-485FC3894386}\Custom.dll

Filesize
36KB

MD5
8291b10f789eb017521faf9103ecc512

SHA1
829aba4f572162a3a2da393300a03263f83a2896

SHA256
9b58c9ad1d54002e943f1487f0316e801d0e8ecb9e65866ca3eee197e0a5c1ea

SHA512
c1a552afb5e9ac5ac6599de50b37b8f2a9cffdd241928e3515c9164114a2fdc1fade5ffb208b26611329b954484e2fae3534110137eebfd65e474e2a6ae7327a

Download Submit
\Users\Admin\AppData\Local\Temp\{186A6170-007D-4F0E-ADE5-485FC3894386}\_Setup.dll

Filesize
24KB

MD5
cc061b6c0d35514508f648fe0389f914

SHA1
16881e4f28c504a59c3eacf66fa9e5bc78c1a6d4

SHA256
4acf5051fbdebfb3f690ded3852fa919ee61449315ddc1bf51debce981e2f167

SHA512
d0c6b3198be0520a1096a4e481f933a50956686c9ffe8365cf7d9de0357bd6815d37bd4675629206663d3075e76cfc8fa055363f558d723a366229e804bc29b3

Download Submit
memory/1452-55-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download