02bd1816e2676ffe3f5ed6a453518407170102b6859ee368adad0ac98ec3aae3

Analysis

max time kernel
23s
max time network
116s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 05:03

Target

02bd1816e2676ffe3f5ed6a453518407170102b6859ee368adad0ac98ec3aae3.exe
Size

326KB
MD5

9ca6f79c8a29b38a713fbed495f7f41a
SHA1

327b5ed97b9ef125229a974b3d37a633c5f9a489
SHA256

02bd1816e2676ffe3f5ed6a453518407170102b6859ee368adad0ac98ec3aae3
SHA512

98ccfec8a980fb10a32ed3620f5d7fd86cb87e02db5e84c84ee25c97e1ec3144b5ba3010ffe4c1f61bc6503320fe7ae0bae5df7a12c2aa38a15a088a1024ba76
SSDEEP

6144:6r4I9uEo2S1YnQmCX492DkwNP3qpYFuT9U1FZA5MRwxuhhfch6clgR:6r4gu6/eIo4nULZKMRwxuPfk6p

Score

7^/10

discovery

Loads dropped DLL 3 IoCs

pid	Process
916	02bd1816e2676ffe3f5ed6a453518407170102b6859ee368adad0ac98ec3aae3.exe
916	02bd1816e2676ffe3f5ed6a453518407170102b6859ee368adad0ac98ec3aae3.exe
916	02bd1816e2676ffe3f5ed6a453518407170102b6859ee368adad0ac98ec3aae3.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\02bd1816e2676ffe3f5ed6a453518407170102b6859ee368adad0ac98ec3aae3.exe
"C:\Users\Admin\AppData\Local\Temp\02bd1816e2676ffe3f5ed6a453518407170102b6859ee368adad0ac98ec3aae3.exe"
1⤵
- Loads dropped DLL
PID:916

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\TsuBE82D04D.dll

Filesize
50KB

MD5
cba3410c80e19fbe5c6fe69d6f2c4179

SHA1
ea4204197a98b27aefa01b368a164d4ccf194e70

SHA256
89fc85da6e975a419beb1991b46c2bc592fd7af6e72fc034ee15fea5e10eef18

SHA512
a9b0771befbe20a3476b3477c2113897e32b004bcc25c1ec040286b0a1c72b4303d878eb7d5f2c70ace707dd7c82dabc7bcbc13acacd88bcd4239cc705772740

Download Submit
\Users\Admin\AppData\Local\Temp\{366350C0-A8D3-4526-A7CD-E0F1ED807236}\Custom.dll

Filesize
33KB

MD5
a5121c57b927d03ec87b24ae5c63ab2c

SHA1
2b22c34b7ec62e82128ebac7bd15f692f3265879

SHA256
fed1f5d99a486f214b1191e52a8881273f05a97b80a3ebafd0e2eebab12b3832

SHA512
0952ace9a3b32c1d33971ec3c2e5d31a89a6416adb645f9adc22c2a156f305a05cebd6fad6f1324f3d63708a76fdfa0b58836f05864511a88c3df04972e93f93

Download Submit
\Users\Admin\AppData\Local\Temp\{366350C0-A8D3-4526-A7CD-E0F1ED807236}\_Setup.dll

Filesize
44KB

MD5
ae1946fabce35a3b6e0a4ade62e7791b

SHA1
f1834e5eaf8e65167ba37510feb4f7582f70a04d

SHA256
3fa8ac206381ec09614dd359f13e010d1c4d5bf2a82316c4f052237bd40873aa

SHA512
ba7c7fe79adcd23c920b9f079a28e7b105ee1519ec011c39ec285ab42a23dfa68edc9bc1e7faca8a382e5a0ee5aba788800bbec224b170657cbb399049992ae0

Download Submit
memory/916-55-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download