Analysis
-
max time kernel
34s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 08:20
Static task
static1
Behavioral task
behavioral1
Sample
656c870f5afc8511fa472b061b4dca07f42c0f6bc13ccf0e25f1491f0bd2b433.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
656c870f5afc8511fa472b061b4dca07f42c0f6bc13ccf0e25f1491f0bd2b433.exe
Resource
win10v2004-20220812-en
General
-
Target
656c870f5afc8511fa472b061b4dca07f42c0f6bc13ccf0e25f1491f0bd2b433.exe
-
Size
314KB
-
MD5
bb16ab43aff15e6958be516628fb9c34
-
SHA1
28d82b24fc9daf9a99db505023a4c157ed076a20
-
SHA256
656c870f5afc8511fa472b061b4dca07f42c0f6bc13ccf0e25f1491f0bd2b433
-
SHA512
da37bc01dc4fa86711ca509924dce1ea6bec0f04e5307e981d6ac2ab9c58a529db2b4748c5f11183392576076cb1ade7634a9c3660e130ae0901177ed72ac61c
-
SSDEEP
6144:yr5bUzkuvcBYC47l2xGnV6OjJaV490B6lKPk3JDEbk0teSVt59:yrqkuveY3RnV6c800oIpbv0SVt59
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
Processes:
656c870f5afc8511fa472b061b4dca07f42c0f6bc13ccf0e25f1491f0bd2b433.exepid process 1044 656c870f5afc8511fa472b061b4dca07f42c0f6bc13ccf0e25f1491f0bd2b433.exe 1044 656c870f5afc8511fa472b061b4dca07f42c0f6bc13ccf0e25f1491f0bd2b433.exe 1044 656c870f5afc8511fa472b061b4dca07f42c0f6bc13ccf0e25f1491f0bd2b433.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
656c870f5afc8511fa472b061b4dca07f42c0f6bc13ccf0e25f1491f0bd2b433.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 656c870f5afc8511fa472b061b4dca07f42c0f6bc13ccf0e25f1491f0bd2b433.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum 656c870f5afc8511fa472b061b4dca07f42c0f6bc13ccf0e25f1491f0bd2b433.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
656c870f5afc8511fa472b061b4dca07f42c0f6bc13ccf0e25f1491f0bd2b433.exepid process 1044 656c870f5afc8511fa472b061b4dca07f42c0f6bc13ccf0e25f1491f0bd2b433.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\656c870f5afc8511fa472b061b4dca07f42c0f6bc13ccf0e25f1491f0bd2b433.exe"C:\Users\Admin\AppData\Local\Temp\656c870f5afc8511fa472b061b4dca07f42c0f6bc13ccf0e25f1491f0bd2b433.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\Tsu251D7B12.dllFilesize
269KB
MD5af7ce801c8471c5cd19b366333c153c4
SHA14267749d020a362edbd25434ad65f98b073581f1
SHA256cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e
SHA51288655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c
-
\Users\Admin\AppData\Local\Temp\{B2F06518-61B8-4E75-AC9E-299A691347EE}\Custom.dllFilesize
91KB
MD5a7245bbd05aa5bee1f34b4c4de90c672
SHA194a148f9b49af78576e9915ad143b17c1d5514e7
SHA2561f749e2a9a754223f0609a4c8c91af2f2771ed52dfd0680fc4ad3c91877c3bc8
SHA5129a395e62a2ab8d096d293eb8d5bc24b91debfc8efe394848dd020987937ea8922b41967cc38bf8f4f8af0c386f1d8c7e31432564146120643d83e33c1904ef8f
-
\Users\Admin\AppData\Local\Temp\{B2F06518-61B8-4E75-AC9E-299A691347EE}\_Setup.dllFilesize
173KB
MD5f5b9122162a09af65e175de7bfe9c3e8
SHA15456548923f763866aae993914b3c96f9f694bce
SHA256250d2be5a8eeef8d991fd5790e4b191c9fe1328739f5ded8920bf9aeae8b26db
SHA512154732149c7d72f32d5a42019221ddb85b996441d3d7793ec04ac21696d66e0186e2165c58901f13e07611366074a1e1dc7ee3e1f87df9eeffa3c402a9a2567f
-
memory/1044-55-0x0000000075601000-0x0000000075603000-memory.dmpFilesize
8KB