Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 06:54
Static task
static1
Behavioral task
behavioral1
Sample
ff2f6651572c98197bf334391f41045c27a0639fb98fe137af7bba3dc6e8fe17.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ff2f6651572c98197bf334391f41045c27a0639fb98fe137af7bba3dc6e8fe17.exe
Resource
win10v2004-20221111-en
General
-
Target
ff2f6651572c98197bf334391f41045c27a0639fb98fe137af7bba3dc6e8fe17.exe
-
Size
315KB
-
MD5
42580bcb0dadc8771595032778b4ee94
-
SHA1
e08a86f6f2e7f307c1519ca87a79bd7ba72c397c
-
SHA256
ff2f6651572c98197bf334391f41045c27a0639fb98fe137af7bba3dc6e8fe17
-
SHA512
ce85ffe555a81865823384c971531126edc2fef00a8eb607de8e3a01b379147d9d55f051a576cb13994a085cfa99d13954ca94b154ed3274ae024636fdc5f70e
-
SSDEEP
6144:kr4bUzkuvcBYC47l2xRBoF15DyKItd1MmQXwjcP2li:kr9kuveY3sg1thmdjcuw
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
Processes:
ff2f6651572c98197bf334391f41045c27a0639fb98fe137af7bba3dc6e8fe17.exepid process 3300 ff2f6651572c98197bf334391f41045c27a0639fb98fe137af7bba3dc6e8fe17.exe 3300 ff2f6651572c98197bf334391f41045c27a0639fb98fe137af7bba3dc6e8fe17.exe 3300 ff2f6651572c98197bf334391f41045c27a0639fb98fe137af7bba3dc6e8fe17.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
ff2f6651572c98197bf334391f41045c27a0639fb98fe137af7bba3dc6e8fe17.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum ff2f6651572c98197bf334391f41045c27a0639fb98fe137af7bba3dc6e8fe17.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum ff2f6651572c98197bf334391f41045c27a0639fb98fe137af7bba3dc6e8fe17.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ff2f6651572c98197bf334391f41045c27a0639fb98fe137af7bba3dc6e8fe17.exepid process 3300 ff2f6651572c98197bf334391f41045c27a0639fb98fe137af7bba3dc6e8fe17.exe 3300 ff2f6651572c98197bf334391f41045c27a0639fb98fe137af7bba3dc6e8fe17.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff2f6651572c98197bf334391f41045c27a0639fb98fe137af7bba3dc6e8fe17.exe"C:\Users\Admin\AppData\Local\Temp\ff2f6651572c98197bf334391f41045c27a0639fb98fe137af7bba3dc6e8fe17.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Tsu3E972C26.dllFilesize
269KB
MD5af7ce801c8471c5cd19b366333c153c4
SHA14267749d020a362edbd25434ad65f98b073581f1
SHA256cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e
SHA51288655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c
-
C:\Users\Admin\AppData\Local\Temp\{9670527C-435E-426C-A087-0B7C4D93708A}\Custom.dllFilesize
91KB
MD514d03f73377c34394451d39fa8364c2c
SHA14312e7abcb79d9d1b4106829fc8290a3df92450a
SHA25677cf95ad8bca51aa6c93805bbeace6eeb40b1b1582c4ddddda7d738359ab523f
SHA512faad5e2d39bd94b36e5a58202e8d7c12ede73c9597d4077d38bc30ce15b32ba4e36769b1bec35bceba2500532ff97dd9da2d8e834042fd723d3d162f9bc2a46a
-
C:\Users\Admin\AppData\Local\Temp\{9670527C-435E-426C-A087-0B7C4D93708A}\_Setup.dllFilesize
173KB
MD51d34ad5425b6fe5db18daaa6f4675959
SHA1c6b0b7fd764938c7776df196902950cef5531ed2
SHA2563303e0cbc8374f5a5c5fc6d4869889b354becf625306e9a6e286af507c7e3877
SHA512dd7a8d468769e1ec64781abe861cc44cb78bee628b94fdb4ecf38c31976d13e6d1b848ef16107770c7175dc2618ea5f421af087e5ba30caa83aa006f836f7f39