Analysis
-
max time kernel
44s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 07:46
Static task
static1
Behavioral task
behavioral1
Sample
b833e3d61e9f6d8c50474ed3ac683d0733e30de4422c0318ab2447370db0d11d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b833e3d61e9f6d8c50474ed3ac683d0733e30de4422c0318ab2447370db0d11d.exe
Resource
win10v2004-20221111-en
General
-
Target
b833e3d61e9f6d8c50474ed3ac683d0733e30de4422c0318ab2447370db0d11d.exe
-
Size
316KB
-
MD5
a6a3b5daf4d5a0a2929a30e755faae3f
-
SHA1
d3fad6a349cca14534c35375f71bac1bdffa8efc
-
SHA256
b833e3d61e9f6d8c50474ed3ac683d0733e30de4422c0318ab2447370db0d11d
-
SHA512
3e87f95be7bf06dc44958860c4178096dcf760a10252515c7adbca25e3e4ff09ea5049680a2028217b7a421b3b81a79026f1048d7d34dec2ab8a33a3f8038739
-
SSDEEP
6144:6ribUzkuvcBYC47l2xLNaFmoKZLxtHU/TMDkW01eedmQb+xC:6r7kuveY33FJUo7MDkA6L
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
Processes:
b833e3d61e9f6d8c50474ed3ac683d0733e30de4422c0318ab2447370db0d11d.exepid process 784 b833e3d61e9f6d8c50474ed3ac683d0733e30de4422c0318ab2447370db0d11d.exe 784 b833e3d61e9f6d8c50474ed3ac683d0733e30de4422c0318ab2447370db0d11d.exe 784 b833e3d61e9f6d8c50474ed3ac683d0733e30de4422c0318ab2447370db0d11d.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
b833e3d61e9f6d8c50474ed3ac683d0733e30de4422c0318ab2447370db0d11d.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum b833e3d61e9f6d8c50474ed3ac683d0733e30de4422c0318ab2447370db0d11d.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum b833e3d61e9f6d8c50474ed3ac683d0733e30de4422c0318ab2447370db0d11d.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
b833e3d61e9f6d8c50474ed3ac683d0733e30de4422c0318ab2447370db0d11d.exepid process 784 b833e3d61e9f6d8c50474ed3ac683d0733e30de4422c0318ab2447370db0d11d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b833e3d61e9f6d8c50474ed3ac683d0733e30de4422c0318ab2447370db0d11d.exe"C:\Users\Admin\AppData\Local\Temp\b833e3d61e9f6d8c50474ed3ac683d0733e30de4422c0318ab2447370db0d11d.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\TsuDDAD23C2.dllFilesize
269KB
MD5af7ce801c8471c5cd19b366333c153c4
SHA14267749d020a362edbd25434ad65f98b073581f1
SHA256cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e
SHA51288655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c
-
\Users\Admin\AppData\Local\Temp\{B9F9EEB7-C5F9-49DB-AB30-8DDB621ACC41}\Custom.dllFilesize
91KB
MD5d2b596fa229e1b03704c9e9c3b4d4aa0
SHA119c57157c2e9b58037a7d2bca4909cbf125e9a23
SHA2561bf33578f57d6436e916cc0734e8adc66a0e3c7ca5de1290601a73e3e362419d
SHA5124e0d8ba8aea2c36ec79c86dcb6febe28ee0788d6a4d94231b5de10930e7fe0d285786bf6bfc3d85d8f1e83a4fb65f0f8a24e691c3298fce60ccef9a434a0d9c0
-
\Users\Admin\AppData\Local\Temp\{B9F9EEB7-C5F9-49DB-AB30-8DDB621ACC41}\_Setup.dllFilesize
173KB
MD5be16f8d320da824f0db58ef6d75c75c6
SHA19c3993bbfa92ca6d5dc2b2721716f5040bb22d82
SHA256a2879be2df754addca789fdd9d7d52dff21687414a2579ed8e05aaf9fb283822
SHA512bbe5e522f5ef988d2ff216a5afc16fd5ee39244839f4ec6382f77d70df1dfe11e35cfad1ec4446ff06849c04c1e681bf312a9ea9623f96eac9e0677bab7eb1f0
-
memory/784-55-0x0000000075FC1000-0x0000000075FC3000-memory.dmpFilesize
8KB