7f5a1b5eb22e79ee31ba9051b4e46f1f2b78676867780c114e6cf678f0fe52b6

Analysis

max time kernel
32s
max time network
39s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 23:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f5a1b5eb22e79ee31ba9051b4e46f1f2b78676867780c114e6cf678f0fe52b6.exe
Size

862KB
MD5

0eea4f31a4e8857e9ca3f2c6dc6d7cb0
SHA1

189d95a6513219433f5e3ae630757e2c485bd718
SHA256

7f5a1b5eb22e79ee31ba9051b4e46f1f2b78676867780c114e6cf678f0fe52b6
SHA512

8ba0e2ae8df3625dc2285b6f5362ac87ac2ba647619dc6d35f2f973512a321c7d9f46904eba9e971ff81e004c931d2ce8d70cb6be0cd4a94658b95ebed901d87
SSDEEP

12288:8llqeyNdG6ZblPmGkNMewf2nrMZaYCq0q+2ax8bywN9ylkuJ+TPw:83qeyNdG6ZB+Gk/wOnQDwLV0Ck+EPw

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1488	7f5a1b5eb22e79ee31ba9051b4e46f1f2b78676867780c114e6cf678f0fe52b6.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\IE10_main.log	7f5a1b5eb22e79ee31ba9051b4e46f1f2b78676867780c114e6cf678f0fe52b6.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	7f5a1b5eb22e79ee31ba9051b4e46f1f2b78676867780c114e6cf678f0fe52b6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	7f5a1b5eb22e79ee31ba9051b4e46f1f2b78676867780c114e6cf678f0fe52b6.exe

C:\Users\Admin\AppData\Local\Temp\7f5a1b5eb22e79ee31ba9051b4e46f1f2b78676867780c114e6cf678f0fe52b6.exe
"C:\Users\Admin\AppData\Local\Temp\7f5a1b5eb22e79ee31ba9051b4e46f1f2b78676867780c114e6cf678f0fe52b6.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
PID:1488

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\Temp\IE14D08.tmp\SQMAPI.DLL

Filesize
229KB

MD5
bdabe7dfe0beb7bcb3e0ab50a4cbe718

SHA1
11af23b7da62b2d880ec4ecf0528c02e990a556d

SHA256
efb2123c694125df5383bb1423c67a2da8a50452d0a4c854f4078d01d39c4ae5

SHA512
f121f397bd0b858ae08448628ce3fbd43aef943e1489ba9d7b6045bb4e14f1d0735f11e9dafcf4b01c66af0b8c1fb41101bbadb5a4e2eb2144006b2e040aa9c1

Download Submit
memory/1488-54-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Filesize
8KB

Download