20ef492fcf0a96aff90eeb53015098598df0e1377bb9234724deb66169776b2a

Analysis

max time kernel
4s
max time network
131s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 08:10

Target

20ef492fcf0a96aff90eeb53015098598df0e1377bb9234724deb66169776b2a.exe
Size

327KB
MD5

dc21adec5baa55c9fcd9e6e65b7b1c64
SHA1

1e7bcbc6ecbeb1a90bdcb77e816e60721162e72a
SHA256

20ef492fcf0a96aff90eeb53015098598df0e1377bb9234724deb66169776b2a
SHA512

9af9985e3525ee61e967cb0b5f1d7e803ba18a014267b1c22a85331dfbc4b0d1b8bab56cc8300093b30e225e7fe4b7a9182967b223bc534816d642455e53dfd5
SSDEEP

6144:0rVbUzkuvcBYC47l2xt81bM31jFryMm/+3pZasr0AtbgTtCybrNMcB:0rGkuveY38aExzr3pZh0d8EJ9B

Score

7^/10

discovery

Loads dropped DLL 3 IoCs

pid	Process
1980	20ef492fcf0a96aff90eeb53015098598df0e1377bb9234724deb66169776b2a.exe
1980	20ef492fcf0a96aff90eeb53015098598df0e1377bb9234724deb66169776b2a.exe
1980	20ef492fcf0a96aff90eeb53015098598df0e1377bb9234724deb66169776b2a.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\20ef492fcf0a96aff90eeb53015098598df0e1377bb9234724deb66169776b2a.exe
"C:\Users\Admin\AppData\Local\Temp\20ef492fcf0a96aff90eeb53015098598df0e1377bb9234724deb66169776b2a.exe"
1⤵
- Loads dropped DLL
PID:1980

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\Tsu9C6DD84D.dll

Filesize
3KB

MD5
8a0a728b6a36366e629b69488ebfbca0

SHA1
297d046329b8e2695a8787c071268db1628f138c

SHA256
c3e6481fef777e85af0c3be935661132d385dcbe0bfd0bea3fd5968b23c0b45b

SHA512
cee0bbcc61b8cc93f39d086f2ee2a87779c2bbc48d60d9f899fcbe0fb09265ffdbde8697c159786912e3687565000194e898bc482304a5d89e7dbb552a7c5f95

Download Submit
\Users\Admin\AppData\Local\Temp\{DA798C0B-D2AB-4EEF-AC04-9A89019AAEFD}\Custom.dll

Filesize
51KB

MD5
b89ef54274d89577baaf6382ff82a02a

SHA1
ff7eec1f6aae8838e1cd52c7036078208c54891b

SHA256
9f803c01913f8d0398f2f35a63e0c23b6b88195d32c57fa7a33dffc18b841f94

SHA512
9db179f22421832af3a04b6b3079d1110d19428498f3ed00f82365543bc749364680ab7194597679a74f92a58cfce5efc071d4fcf174df064c226c159080c554

Download Submit
\Users\Admin\AppData\Local\Temp\{DA798C0B-D2AB-4EEF-AC04-9A89019AAEFD}\_Setup.dll

Filesize
97KB

MD5
87602c38187ded724335037d3c72d99f

SHA1
8934e80a7955bdbd88f9761ec1f94d936e29a050

SHA256
34e44ccf6629b2abff4012f190a1dd7910a958ef61fa68ae88c52a9edac6893a

SHA512
009d60bde57171fcee3e2ea9d9506a3ca6ab83cf581781b9e0e4af1c8d87106414bc7e37bbad6e365df663bdb71221a493c9b2df1ed8e112982953089c0d8a46

Download Submit
memory/1980-55-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download