ab084b0485647ca3fcd1734e0b6289c4047e36659ed0cb022fe4f8b8e59e3c8b

Analysis

max time kernel
32s
max time network
60s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 13:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab084b0485647ca3fcd1734e0b6289c4047e36659ed0cb022fe4f8b8e59e3c8b.exe
Size

315KB
MD5

71b391d0b819ff6eaa2102a4675de05c
SHA1

ef576d715141b3bb7cf1e7a520490b3160442f80
SHA256

ab084b0485647ca3fcd1734e0b6289c4047e36659ed0cb022fe4f8b8e59e3c8b
SHA512

ca596f10b45f16fe589bde09a94dbe9e1b456d6ae5950061ab617927f792b74231dfb1dd3811303a77ecc864f99832df94175efeee3ad66111bb267f817d423e
SSDEEP

6144:6rcbUzkuvcBYC47l2x6VhrsvjcGUk6u2EOhB6nzuY5w:6rhkuveY3bGkz6zuY5w

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1644	ab084b0485647ca3fcd1734e0b6289c4047e36659ed0cb022fe4f8b8e59e3c8b.exe
1644	ab084b0485647ca3fcd1734e0b6289c4047e36659ed0cb022fe4f8b8e59e3c8b.exe
1644	ab084b0485647ca3fcd1734e0b6289c4047e36659ed0cb022fe4f8b8e59e3c8b.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	ab084b0485647ca3fcd1734e0b6289c4047e36659ed0cb022fe4f8b8e59e3c8b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	ab084b0485647ca3fcd1734e0b6289c4047e36659ed0cb022fe4f8b8e59e3c8b.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1644	ab084b0485647ca3fcd1734e0b6289c4047e36659ed0cb022fe4f8b8e59e3c8b.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1924	1644	ab084b0485647ca3fcd1734e0b6289c4047e36659ed0cb022fe4f8b8e59e3c8b.exe	31
PID 1644 wrote to memory of 1924	1644	ab084b0485647ca3fcd1734e0b6289c4047e36659ed0cb022fe4f8b8e59e3c8b.exe	31
PID 1644 wrote to memory of 1924	1644	ab084b0485647ca3fcd1734e0b6289c4047e36659ed0cb022fe4f8b8e59e3c8b.exe	31
PID 1644 wrote to memory of 1924	1644	ab084b0485647ca3fcd1734e0b6289c4047e36659ed0cb022fe4f8b8e59e3c8b.exe	31

C:\Users\Admin\AppData\Local\Temp\ab084b0485647ca3fcd1734e0b6289c4047e36659ed0cb022fe4f8b8e59e3c8b.exe
"C:\Users\Admin\AppData\Local\Temp\ab084b0485647ca3fcd1734e0b6289c4047e36659ed0cb022fe4f8b8e59e3c8b.exe"
1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tinFE67.bat"
  2⤵
  PID:1924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\InstallMate\13515B09\cfg\1.ini

Filesize
41KB

MD5
c5d92447de5f55b3eba662ca4c82480e

SHA1
7af64e2eb142c547ee03414d1af27cee877d7138

SHA256
76b1979fac07be6ef0192f08caa0463c6a23e5bf1100b95ebc73805fe8e3455a

SHA512
aa09afd3a4ae919c1deec8d10fc27441c1ecffd14b51a187c7a1cffa1bb59dad53531f89a73de6af4b030c4317ff3f41890def3abae5e746a45899aadfca3b8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_tinFE67.bat

Filesize
50B

MD5
4b12272309674d8c87518312a61f8cf5

SHA1
f468e54ef95ddbfb96c9e58b528215bfb8889cd2

SHA256
1b84e8660cad98fdb2eb74fc2867aad5812a13ee07d623c1a90e8e931aa48b78

SHA512
cae171cdbff5775554c1f6b24cb990a838af3a2be1359829c59052a2ebe7af710640ad029b99a89a701f3b4140fd991681b484c85ab8ea51a8b199aef8e5d573

Download Submit
\Users\Admin\AppData\Local\Temp\Tsu3B44242F.dll

Filesize
269KB

MD5
af7ce801c8471c5cd19b366333c153c4

SHA1
4267749d020a362edbd25434ad65f98b073581f1

SHA256
cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

SHA512
88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

Download Submit
\Users\Admin\AppData\Local\Temp\{5FCB2A91-4381-4CB7-AE5C-0BA384280867}\Custom.dll

Filesize
91KB

MD5
2580b4f2c4522fe5cb36e6d3ec09b24a

SHA1
39bbe49606478a8d9abcdeca1e84040b4411f219

SHA256
7b89020c401d0b5dd46aea117303ec67392eb295555dbfd26ac3beef8417eb00

SHA512
eb2c377bcfdc3e9f587e0262c109856abbb07cb9ce3b28d9ec37f0862a611823ea5c856ead54afef0817162e72c51540da053bf4453039d0977f8fdd1050f413

Download Submit
\Users\Admin\AppData\Local\Temp\{5FCB2A91-4381-4CB7-AE5C-0BA384280867}\_Setup.dll

Filesize
173KB

MD5
9b02f9d7afb338368b1aab73f21708cd

SHA1
a0388f5f972226beea6f6a030deca269d3ffe2dd

SHA256
2fda616670264c4cc03f1ce8420dfcc79b79920e836737f6cee360d51413805f

SHA512
6381df05f90e9fe07e35c53f7f601ddb74f42988140ca6af075a3edd60282f5620250cd9e86c3a5b04fef2ce4b6cf7971773fdf5a416c271b4381a788dd453e4

Download Submit
memory/1644-55-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download