Analysis
-
max time kernel
34s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07-11-2022 03:10
Static task
static1
Behavioral task
behavioral1
Sample
9e5be51f715ed5cf7046f59f6b36feb86fe9f678ad8eba8a108ae130135ed78c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9e5be51f715ed5cf7046f59f6b36feb86fe9f678ad8eba8a108ae130135ed78c.exe
Resource
win10v2004-20220812-en
General
-
Target
9e5be51f715ed5cf7046f59f6b36feb86fe9f678ad8eba8a108ae130135ed78c.exe
-
Size
315KB
-
MD5
0d096c41468eef89bd1f0704d325b510
-
SHA1
e108d0841af92c895872f982d4bb2c9aaca53be1
-
SHA256
9e5be51f715ed5cf7046f59f6b36feb86fe9f678ad8eba8a108ae130135ed78c
-
SHA512
7ab69573389d736ed0a4fa0c604f2ab2aadb912450e0703bd0adbf3b06ebe43d49e67ea02e6bd3c3829fab1e677a5d0872f5b751e4b3d1755fce953e6b2b38d0
-
SSDEEP
6144:HrpbUzkuvcBYC47l2xyfalkLUsx4Y0k8ojcX/pJ2enmrIJzO1LBut0njxxuQ9UF:HrakuveY3hfaaLUsx4JkxjYJ2emrCz2i
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 1692 9e5be51f715ed5cf7046f59f6b36feb86fe9f678ad8eba8a108ae130135ed78c.exe 1692 9e5be51f715ed5cf7046f59f6b36feb86fe9f678ad8eba8a108ae130135ed78c.exe 1692 9e5be51f715ed5cf7046f59f6b36feb86fe9f678ad8eba8a108ae130135ed78c.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 9e5be51f715ed5cf7046f59f6b36feb86fe9f678ad8eba8a108ae130135ed78c.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum 9e5be51f715ed5cf7046f59f6b36feb86fe9f678ad8eba8a108ae130135ed78c.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1692 9e5be51f715ed5cf7046f59f6b36feb86fe9f678ad8eba8a108ae130135ed78c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e5be51f715ed5cf7046f59f6b36feb86fe9f678ad8eba8a108ae130135ed78c.exe"C:\Users\Admin\AppData\Local\Temp\9e5be51f715ed5cf7046f59f6b36feb86fe9f678ad8eba8a108ae130135ed78c.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:1692
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
269KB
MD5af7ce801c8471c5cd19b366333c153c4
SHA14267749d020a362edbd25434ad65f98b073581f1
SHA256cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e
SHA51288655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c
-
Filesize
91KB
MD5a6312af27b3d15b556341f63bce617ed
SHA127d5724ba3c3d14065184558a434a0e78e742edb
SHA256432adc14aeb197e7bc24a77d29a18e82b7c02047efb3a354e0c2ce95719a8cae
SHA512c08ec354dcd7e3455ad419d13d4cd3e748f8579b089baa9e0c0347ccd58bc80333d066fe291e5a120b58fe3603a8a084771f6d80c73c433c9b0f00931e4f3f8a
-
Filesize
173KB
MD5081c1ac0aaaaec8b4eb06c541a40592e
SHA1bedb928c8c3a44942405de146c7b6bd63a438c65
SHA2567db7c245ad224e7018f5478b3f7c4695144fe65319973c8c536840bba53e9ab8
SHA512df96ea85e670ef0c58108d92683115480ef57174e341672edc26d111738560bbe17781a26fe62da2d9091fdfc6e1a70f1822b09f22be7893ebecd7d08dcc57b2