f92b4f1c030ae2efe3fb69a6c7be363ae3dc3ce2c406a815741e5cfb21c57c92

Analysis

max time kernel
36s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f92b4f1c030ae2efe3fb69a6c7be363ae3dc3ce2c406a815741e5cfb21c57c92.exe
Size

325KB
MD5

5ecaf161b3094ba8e7170d4b9231af70
SHA1

a783a1854bd0c8dae66262fc03483a33c3c1d0a2
SHA256

f92b4f1c030ae2efe3fb69a6c7be363ae3dc3ce2c406a815741e5cfb21c57c92
SHA512

93e26789f0434eb70e1491867aa23727f6b0b35b041c0a03de94a870baf4868cb4cf1542d3ae9131e0750c6fa3b3c2f384924d4ace74830517c34b79e2c61305
SSDEEP

6144:sr1Bh9uEo2S1YnQmCX492DkwNP3qpYFDcYgQUskKWeFCEQOiCYOqmO5o9:sr1B3u6/eIo4ArVUBQCCYOqmO5o9

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1608	f92b4f1c030ae2efe3fb69a6c7be363ae3dc3ce2c406a815741e5cfb21c57c92.exe
1608	f92b4f1c030ae2efe3fb69a6c7be363ae3dc3ce2c406a815741e5cfb21c57c92.exe
1608	f92b4f1c030ae2efe3fb69a6c7be363ae3dc3ce2c406a815741e5cfb21c57c92.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	f92b4f1c030ae2efe3fb69a6c7be363ae3dc3ce2c406a815741e5cfb21c57c92.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	f92b4f1c030ae2efe3fb69a6c7be363ae3dc3ce2c406a815741e5cfb21c57c92.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1608	f92b4f1c030ae2efe3fb69a6c7be363ae3dc3ce2c406a815741e5cfb21c57c92.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 1540	1608	f92b4f1c030ae2efe3fb69a6c7be363ae3dc3ce2c406a815741e5cfb21c57c92.exe	29
PID 1608 wrote to memory of 1540	1608	f92b4f1c030ae2efe3fb69a6c7be363ae3dc3ce2c406a815741e5cfb21c57c92.exe	29
PID 1608 wrote to memory of 1540	1608	f92b4f1c030ae2efe3fb69a6c7be363ae3dc3ce2c406a815741e5cfb21c57c92.exe	29
PID 1608 wrote to memory of 1540	1608	f92b4f1c030ae2efe3fb69a6c7be363ae3dc3ce2c406a815741e5cfb21c57c92.exe	29

C:\Users\Admin\AppData\Local\Temp\f92b4f1c030ae2efe3fb69a6c7be363ae3dc3ce2c406a815741e5cfb21c57c92.exe
"C:\Users\Admin\AppData\Local\Temp\f92b4f1c030ae2efe3fb69a6c7be363ae3dc3ce2c406a815741e5cfb21c57c92.exe"
1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tin9F8B.bat"
  2⤵
  PID:1540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\InstallMate\9C089B56\cfg\1.ini

Filesize
870B

MD5
64dbec4ffaac45b60e877f9329448e5e

SHA1
48648e8db6ea53196c72ee40cb6955df8f8dddd0

SHA256
575273b4a1a8b175abc2ad19bc3e87a9716348c5f11b449e3c91772e8d1b964a

SHA512
ab0395611d2b11aa2369c5b97de1c338a6d594cb1f60fd3c20f8298af8e00cfe373f4390ba9f08734e17c81aaa167f124bddb79d359497290417b7b28ab54793

Download Submit
C:\Users\Admin\AppData\Local\Temp\_tin9F8B.bat

Filesize
50B

MD5
288b60ec3a898f670b8efee41b089d2e

SHA1
7009e682a53db43d740392260a0b422f6751950c

SHA256
4084aa53b192738059e81c340e6353c8aba682186d701816766b78db0c605b15

SHA512
f897d7f4282c2075da05f69549143fe334328e92a677ed53c3537295dea1025f954e08ea0d0f4c3b11b3179520e63223d6314909121efe600382a3a5e94d6e97

Download Submit
\Users\Admin\AppData\Local\Temp\Tsu8BB53DC9.dll

Filesize
269KB

MD5
af7ce801c8471c5cd19b366333c153c4

SHA1
4267749d020a362edbd25434ad65f98b073581f1

SHA256
cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

SHA512
88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

Download Submit
\Users\Admin\AppData\Local\Temp\{7AF85013-8460-4BD2-A939-CC42A11B72E5}\Custom.dll

Filesize
91KB

MD5
736682c6d96bb1edc84e77041faae33d

SHA1
f8f6e20cd2aa23010b85ea289c3bc3cbdbc9ae26

SHA256
54346f2e36bdb512ef4f7d702f18e59a746f0b936786bc76a30e87de0a061f17

SHA512
fe24353f0f4acafbde7d8cec7a5078668f5e6cd0b06c3e0c96cb3fed0beb3c8af2becb1d97fcbb369ac38193827c8d8a440694c79b5da3180224377e38f53777

Download Submit
\Users\Admin\AppData\Local\Temp\{7AF85013-8460-4BD2-A939-CC42A11B72E5}\_Setup.dll

Filesize
180KB

MD5
a475792794328d8a503568cbe38e8531

SHA1
47e5c4857f272898ed515e939f92cb9243b2ce2e

SHA256
2cd6c67a711059c2245615d80ee0e7d44a003b66d5577513b1dfb1bd7f1e7312

SHA512
3ea14ace569233dd69e730b4dfae4f1292d2e950aa26aceeae78715d0831ff6919d1bbf7c70ec256dd8a5db7f2d09ea4f29a564c125b54fdf8c7de2c78631184

Download Submit
memory/1540-58-0x0000000000000000-mapping.dmp

Download
memory/1608-55-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download