82ea76659ab0a5e4617e3f7b3bacfbf7b76862d52a727ac21dd8746610c6c8e5

Analysis

max time kernel
113s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 15:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4kstogram_4.4.2_x64_online.exe
Size

725KB
MD5

8a18a1ff021807632b5b26b9a78e2a38
SHA1

38653362368b96e60962dc76f47a5c750a668fe7
SHA256

82ea76659ab0a5e4617e3f7b3bacfbf7b76862d52a727ac21dd8746610c6c8e5
SHA512

8881a3b07096c15256b773bd018de1354988c5cc2fde4c73e06ce6679dbef42dd4f007de72ae39ad50d3b9324920fe92a47db2ae60b4b851955f56dc657d6431
SSDEEP

12288:JzNB0JfiwSdYSui8zZH94I3H1v1kDs2rOu2i/G6bQXS+1Zk6XcJO:FNsfiTdYSuVzZH9tH1v1Ss2rOy/ez1nt

Score

8^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
992	4kstogram_4.4.2_x64_online.exe

Loads dropped DLL 1 IoCs

pid	Process
992	4kstogram_4.4.2_x64_online.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
992	4kstogram_4.4.2_x64_online.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 992	1604	4kstogram_4.4.2_x64_online.exe	80
PID 1604 wrote to memory of 992	1604	4kstogram_4.4.2_x64_online.exe	80
PID 1604 wrote to memory of 992	1604	4kstogram_4.4.2_x64_online.exe	80

C:\Users\Admin\AppData\Local\Temp\4kstogram_4.4.2_x64_online.exe
"C:\Users\Admin\AppData\Local\Temp\4kstogram_4.4.2_x64_online.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\Temp\{D4D957A3-DEFA-4E36-B071-C896439984E2}\.cr\4kstogram_4.4.2_x64_online.exe
  "C:\Windows\Temp\{D4D957A3-DEFA-4E36-B071-C896439984E2}\.cr\4kstogram_4.4.2_x64_online.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\4kstogram_4.4.2_x64_online.exe" -burn.filehandle.attached=528 -burn.filehandle.self=536
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  PID:992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\{D4D957A3-DEFA-4E36-B071-C896439984E2}\.cr\4kstogram_4.4.2_x64_online.exe

Filesize
725KB

MD5
8a18a1ff021807632b5b26b9a78e2a38

SHA1
38653362368b96e60962dc76f47a5c750a668fe7

SHA256
82ea76659ab0a5e4617e3f7b3bacfbf7b76862d52a727ac21dd8746610c6c8e5

SHA512
8881a3b07096c15256b773bd018de1354988c5cc2fde4c73e06ce6679dbef42dd4f007de72ae39ad50d3b9324920fe92a47db2ae60b4b851955f56dc657d6431

Download Submit
C:\Windows\Temp\{D4D957A3-DEFA-4E36-B071-C896439984E2}\.cr\4kstogram_4.4.2_x64_online.exe

Filesize
725KB

MD5
8a18a1ff021807632b5b26b9a78e2a38

SHA1
38653362368b96e60962dc76f47a5c750a668fe7

SHA256
82ea76659ab0a5e4617e3f7b3bacfbf7b76862d52a727ac21dd8746610c6c8e5

SHA512
8881a3b07096c15256b773bd018de1354988c5cc2fde4c73e06ce6679dbef42dd4f007de72ae39ad50d3b9324920fe92a47db2ae60b4b851955f56dc657d6431

Download Submit
C:\Windows\Temp\{FBDD1194-8B9E-4515-BABE-D0C737F41FB2}\.ba\wixstdba.dll

Filesize
184KB

MD5
fe7e0bd53f52e6630473c31299a49fdd

SHA1
f706f45768bfb95f4c96dfa0be36df57aa863898

SHA256
2bea14d70943a42d344e09b7c9de5562fa7e109946e1c615dd584da30d06cc80

SHA512
feed48286b1e182996a3664f0facdf42aae3692d3d938ea004350c85764db7a0bea996dfddf7a77149c0d4b8b776fb544e8b1ce5e9944086a5b1ed6a8a239a3c

Download Submit