499a7aae82fd4c1903c92c4f1c0564886fce70cb94ab3bd33395e0e5fe2f9b85

Analysis

max time kernel
7s
max time network
2s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 04:16

Target

499a7aae82fd4c1903c92c4f1c0564886fce70cb94ab3bd33395e0e5fe2f9b85.exe
Size

313KB
MD5

bcc11e659bce817533b43dad3c23da61
SHA1

cfecfe4a4f718dedad1f17e96388cf6933fd78ef
SHA256

499a7aae82fd4c1903c92c4f1c0564886fce70cb94ab3bd33395e0e5fe2f9b85
SHA512

77f7db44e55c55207a6531cf7832fc2a69edbafb68fd42a85599e1c92f227d829d1c0ba808741eeea7fdd6008ef528801c12aa846dc0012b480f2e014e90484d
SSDEEP

6144:frK9uEo2S1YnQmCX492DkwNP3qpYFtcM7dZssr+Ixf6LuDTKD2ay9KGYG0LH:fryu6/eIo4vMResyEf0uP9d9UG0H

Score

7^/10

discovery

Loads dropped DLL 3 IoCs

pid	Process
540	499a7aae82fd4c1903c92c4f1c0564886fce70cb94ab3bd33395e0e5fe2f9b85.exe
540	499a7aae82fd4c1903c92c4f1c0564886fce70cb94ab3bd33395e0e5fe2f9b85.exe
540	499a7aae82fd4c1903c92c4f1c0564886fce70cb94ab3bd33395e0e5fe2f9b85.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\499a7aae82fd4c1903c92c4f1c0564886fce70cb94ab3bd33395e0e5fe2f9b85.exe
"C:\Users\Admin\AppData\Local\Temp\499a7aae82fd4c1903c92c4f1c0564886fce70cb94ab3bd33395e0e5fe2f9b85.exe"
1⤵
- Loads dropped DLL
PID:540

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\Tsu0E77D30A.dll

Filesize
50KB

MD5
33b4363dffe11f00e410bcb64aeec008

SHA1
90d4ac96ad05d756100e2a6d4ab20df6d86c5a8f

SHA256
1b53f7c2cb46f1e72e782cbe80f0e05693fcbf639510d31503a0255c3c67ec7c

SHA512
9d0ec5970aa4bc6be558aa6ea1c483cc89c0d821d021af646af771d6d5f7f5277c67a6002373c761002f2860de01e4dd90068fe074ee830678255b15de628256

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3FB3CDFD-711E-41BA-A351-393CE450EF0B}\Custom.dll

Filesize
57KB

MD5
0323706bd7c62881b3920988e264e6a2

SHA1
173717a949c7f9b7c7e14f99b2973a4eff447f9e

SHA256
dc02547a84358d90e32b2f3c0291003210426486d2f9f4924cd67a86b3e77e07

SHA512
7232f8579077a5c4c81cc69d099664a49bc0a1b470734d15cb703224278de8505f3445047a6bcfe429b02ee4067b6a93f16ff2c807fa4be4c8d4e437305a9faa

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3FB3CDFD-711E-41BA-A351-393CE450EF0B}\_Setup.dll

Filesize
26KB

MD5
0c59d3e6cb09bda9d190c3a8936c7aaf

SHA1
cfd3ac14f861c18e73e90aa2cf9e4dda351324ae

SHA256
2551504a50edbb1b3331c9710f5ec6f676ddaa086e00d1df29993e1769f60556

SHA512
abf35aa25e867f8239051713b96ac67d84db4a435c5eba8c915d0cf25bdbddff11617acb830b3c62209ac84c4a7c5c8f1410acaeb6298d30a42cb5f2de745ca2

Download Submit