ff02cfc6f895de515cfe119c007d13064f38f4b8c42b9ff2cf0ef86ce1817b49

General

Target

ff02cfc6f895de515cfe119c007d13064f38f4b8c42b9ff2cf0ef86ce1817b49.exe
Size

313KB
MD5

afaebecb10390ea6cf8382f053d912e9
SHA1

e7852a159eee7caf22c1ed99e941c75970fa8318
SHA256

ff02cfc6f895de515cfe119c007d13064f38f4b8c42b9ff2cf0ef86ce1817b49
SHA512

91fbbbf1f0260ba42e6d0250a8fedcc8b5833d44a01d1b0d3ae4ee91939d437d13a2f535061d71dcc699cf5d04526e4f2278b82094a14b3fa95412b71b8e96fa
SSDEEP

6144:prb9uEo2S1YnQmCX492DkwNP3qpYFl2YyPuFITzyccux7rnrOzprCoMI:prRu6/eIo4t3PuFITKUAn

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

Processes:

ff02cfc6f895de515cfe119c007d13064f38f4b8c42b9ff2cf0ef86ce1817b49.exe

pid	process
1712	ff02cfc6f895de515cfe119c007d13064f38f4b8c42b9ff2cf0ef86ce1817b49.exe
1712	ff02cfc6f895de515cfe119c007d13064f38f4b8c42b9ff2cf0ef86ce1817b49.exe
1712	ff02cfc6f895de515cfe119c007d13064f38f4b8c42b9ff2cf0ef86ce1817b49.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ff02cfc6f895de515cfe119c007d13064f38f4b8c42b9ff2cf0ef86ce1817b49.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	ff02cfc6f895de515cfe119c007d13064f38f4b8c42b9ff2cf0ef86ce1817b49.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	ff02cfc6f895de515cfe119c007d13064f38f4b8c42b9ff2cf0ef86ce1817b49.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

ff02cfc6f895de515cfe119c007d13064f38f4b8c42b9ff2cf0ef86ce1817b49.exe

pid process

1712 ff02cfc6f895de515cfe119c007d13064f38f4b8c42b9ff2cf0ef86ce1817b49.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ff02cfc6f895de515cfe119c007d13064f38f4b8c42b9ff2cf0ef86ce1817b49.exe

description	pid	process	target process
PID 1712 wrote to memory of 240	1712	ff02cfc6f895de515cfe119c007d13064f38f4b8c42b9ff2cf0ef86ce1817b49.exe	cmd.exe
PID 1712 wrote to memory of 240	1712	ff02cfc6f895de515cfe119c007d13064f38f4b8c42b9ff2cf0ef86ce1817b49.exe	cmd.exe
PID 1712 wrote to memory of 240	1712	ff02cfc6f895de515cfe119c007d13064f38f4b8c42b9ff2cf0ef86ce1817b49.exe	cmd.exe
PID 1712 wrote to memory of 240	1712	ff02cfc6f895de515cfe119c007d13064f38f4b8c42b9ff2cf0ef86ce1817b49.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\ff02cfc6f895de515cfe119c007d13064f38f4b8c42b9ff2cf0ef86ce1817b49.exe
"C:\Users\Admin\AppData\Local\Temp\ff02cfc6f895de515cfe119c007d13064f38f4b8c42b9ff2cf0ef86ce1817b49.exe"
1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tin2308.bat"
2⤵
PID:240

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\InstallMate\5DB2B066\cfg\1.ini

Filesize
977B

MD5
e829e5675a6ee8d096a23a6b2e3ce226

SHA1
472004576b5a4c59adaaee5f0d6b5688f15fc459

SHA256
b6f2d9b553b98996155dd6288401f0422b48abd9f0a0be0f9c07fbf1ab6489e2

SHA512
2a25f6c39c00eb27b0da918dc39e00ea891eb8dc95c36aed2c850df588642a62d8c6bce9bb8021d2994a1c3914c0b2f4ad97dc056bfe78f0d4ff3abe042e4be1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_tin2308.bat

Filesize
50B

MD5
3b9f68f18a854ae9a15b21fa24a992de

SHA1
ac61876414ac717f07a6b1eaf2fbbc4715ab2761

SHA256
ffeb8d3f02b1d7c308396c467ea009d6069a807e8741340f428cce4ba0009d4e

SHA512
8f6763eb619e56de4a07a908cd7f327f7b299377413e38c1f81c164f142d464d2d8cda73e146a1f13c0ec78b377104d80f310d0f3e85eec79c1eaf4f8165e987

Download Submit
\Users\Admin\AppData\Local\Temp\Tsu2E6730A8.dll

Filesize
269KB

MD5
af7ce801c8471c5cd19b366333c153c4

SHA1
4267749d020a362edbd25434ad65f98b073581f1

SHA256
cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

SHA512
88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

Download Submit
\Users\Admin\AppData\Local\Temp\{F1BBE953-329D-4F47-ADAC-7ABF2A58CBA5}\Custom.dll

Filesize
91KB

MD5
0842e2723fff1f80955c9dbd38019c75

SHA1
bea88c3fe74817b048951bd218e70d9dead617d9

SHA256
d71cea96d49b48f8702337d01681b2f144aca8acb56a699b9599106c11cc7458

SHA512
28acff8e01224291aa67f57b2d514db84a79fc2cf7ed28ed2e2cecbdf070fb3b1cf52e295a9412641422338f78d86fc6ea21d835a8de21565a8f53d24c604b02

Download Submit
\Users\Admin\AppData\Local\Temp\{F1BBE953-329D-4F47-ADAC-7ABF2A58CBA5}\_Setup.dll

Filesize
169KB

MD5
e991f79040937530c20ae0db2f74e4db

SHA1
6be9fe304687ac1c9ae4feae500eb7f683c27e86

SHA256
ade2b71ba0f45678470346f25803d1822ab7cf072b122b91f0a8feead799c87e

SHA512
fd069a1658006a4f0ada522bfe93a9a30f3ff058b54803556c8e6d0b3d1d3944072e2c2a5d0c5342986fc8af955abec3d974bea0a944e69e2c3e682954283790

Download Submit
memory/240-58-0x0000000000000000-mapping.dmp

Download
memory/1712-55-0x0000000075651000-0x0000000075653000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads