Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 07:50
Static task
static1
Behavioral task
behavioral1
Sample
b47e8252defb9426163d448aebf3ef8bffead2f84916a83f2d7256d0b957c322.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b47e8252defb9426163d448aebf3ef8bffead2f84916a83f2d7256d0b957c322.exe
Resource
win10v2004-20220812-en
General
-
Target
b47e8252defb9426163d448aebf3ef8bffead2f84916a83f2d7256d0b957c322.exe
-
Size
314KB
-
MD5
adee40fd23f17db7681b0d49f59485fa
-
SHA1
df324da199ab4f6401468906f4226815f01fc623
-
SHA256
b47e8252defb9426163d448aebf3ef8bffead2f84916a83f2d7256d0b957c322
-
SHA512
a5d4cff12228aa6b7752adb4f82a3eac57ca6c5f4dfc6017290b518d03b48455fc6c43f163f5c1470b3be7cb4e79d1b4bb6d1d36bc0dda707a8e507306566222
-
SSDEEP
6144:9r2bUzkuvcBYC47l2xib6HwzFyytCr88oDG1GI25i1snqq0o:9r/kuveY3dGwUECr88oDG1GIS+bq0o
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
Processes:
b47e8252defb9426163d448aebf3ef8bffead2f84916a83f2d7256d0b957c322.exepid process 4700 b47e8252defb9426163d448aebf3ef8bffead2f84916a83f2d7256d0b957c322.exe 4700 b47e8252defb9426163d448aebf3ef8bffead2f84916a83f2d7256d0b957c322.exe 4700 b47e8252defb9426163d448aebf3ef8bffead2f84916a83f2d7256d0b957c322.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
b47e8252defb9426163d448aebf3ef8bffead2f84916a83f2d7256d0b957c322.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum b47e8252defb9426163d448aebf3ef8bffead2f84916a83f2d7256d0b957c322.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum b47e8252defb9426163d448aebf3ef8bffead2f84916a83f2d7256d0b957c322.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
b47e8252defb9426163d448aebf3ef8bffead2f84916a83f2d7256d0b957c322.exepid process 4700 b47e8252defb9426163d448aebf3ef8bffead2f84916a83f2d7256d0b957c322.exe 4700 b47e8252defb9426163d448aebf3ef8bffead2f84916a83f2d7256d0b957c322.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b47e8252defb9426163d448aebf3ef8bffead2f84916a83f2d7256d0b957c322.exe"C:\Users\Admin\AppData\Local\Temp\b47e8252defb9426163d448aebf3ef8bffead2f84916a83f2d7256d0b957c322.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:4700
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
269KB
MD5af7ce801c8471c5cd19b366333c153c4
SHA14267749d020a362edbd25434ad65f98b073581f1
SHA256cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e
SHA51288655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c
-
Filesize
91KB
MD51e003f7cd537f729059dbf13c4b177ed
SHA18b13d68eeee3e3be94d961e03a57353245df2fdd
SHA2563b4b5014529df5e4884b64e60c2bbb0a21c986a15f84d82dc2d4490a020741f4
SHA5127ca111f01d6e9180bf1c5b8d6875e92182edf40c211888716ee1288d08dd7b68dacaeeaf2acc614d2cf4ca49a1eaa5228b5124572f628a937f895b05f5764fc0
-
Filesize
173KB
MD5f6d936594abe3af2e6a7aa6e58cb26c4
SHA14592b94ae4ccd795cdc758627239073264ac4ae9
SHA2563cc0918fc22ec780a8523c53dc114c854ef204849b493b95426d3d70e5e673a5
SHA512a85066315502e32002cc56bb0f126f26a4b1048424888f102611c0095d24db67d437f61e1cca0346f7c3e6453fc6c572ff5de2cc0029d501163e7abc7030c84a