Analysis
-
max time kernel
177s -
max time network
226s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 08:03
Static task
static1
Behavioral task
behavioral1
Sample
99a2b294031eb55261289f5fb3312c3b08ae3fa2c0879a79935bbf753d382c33.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
99a2b294031eb55261289f5fb3312c3b08ae3fa2c0879a79935bbf753d382c33.exe
Resource
win10v2004-20221111-en
General
-
Target
99a2b294031eb55261289f5fb3312c3b08ae3fa2c0879a79935bbf753d382c33.exe
-
Size
313KB
-
MD5
fe65075f42323f7c207ee634a92301f7
-
SHA1
75f8596af174a392fa8688b1de03637065a21f37
-
SHA256
99a2b294031eb55261289f5fb3312c3b08ae3fa2c0879a79935bbf753d382c33
-
SHA512
e6e87b8881a9449931116fb3209a2eedd6552555887edd13a5d71996d8099aa4897ae2fca7a875cfbc9bcfcf19711840c1f8ba9ab944c14bfaff84e2611d9be7
-
SSDEEP
6144:CrkP9uEo2S1YnQmCX492DkwNP3qpYFpdteedaMtBxOWUevASojincBSh:CrkFu6/eIo4mdt2M/lUevAzica
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
Processes:
99a2b294031eb55261289f5fb3312c3b08ae3fa2c0879a79935bbf753d382c33.exepid process 1756 99a2b294031eb55261289f5fb3312c3b08ae3fa2c0879a79935bbf753d382c33.exe 1756 99a2b294031eb55261289f5fb3312c3b08ae3fa2c0879a79935bbf753d382c33.exe 1756 99a2b294031eb55261289f5fb3312c3b08ae3fa2c0879a79935bbf753d382c33.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
99a2b294031eb55261289f5fb3312c3b08ae3fa2c0879a79935bbf753d382c33.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 99a2b294031eb55261289f5fb3312c3b08ae3fa2c0879a79935bbf753d382c33.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum 99a2b294031eb55261289f5fb3312c3b08ae3fa2c0879a79935bbf753d382c33.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
99a2b294031eb55261289f5fb3312c3b08ae3fa2c0879a79935bbf753d382c33.exepid process 1756 99a2b294031eb55261289f5fb3312c3b08ae3fa2c0879a79935bbf753d382c33.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\99a2b294031eb55261289f5fb3312c3b08ae3fa2c0879a79935bbf753d382c33.exe"C:\Users\Admin\AppData\Local\Temp\99a2b294031eb55261289f5fb3312c3b08ae3fa2c0879a79935bbf753d382c33.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\Tsu644FA5C3.dllFilesize
269KB
MD5af7ce801c8471c5cd19b366333c153c4
SHA14267749d020a362edbd25434ad65f98b073581f1
SHA256cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e
SHA51288655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c
-
\Users\Admin\AppData\Local\Temp\{617F877D-CE4E-44D8-A633-866CBA9CA58B}\Custom.dllFilesize
91KB
MD51ddad019fb1368d41772a70d80ed78dd
SHA12a622f9767b15216b00c7ec03de0100ce8bdced3
SHA2568a9773f1d8bcd315888bcf4ef3e7dbbf4a84147aa6c1a920330326f97a240f4f
SHA512a539e5048285bdd432bde5ec572b97ae47522000ea51da2264612345d498758e9ba21513328b55be4e4a31d004ebd02975c2405d4b3911809680c1f97cb3b3fa
-
\Users\Admin\AppData\Local\Temp\{617F877D-CE4E-44D8-A633-866CBA9CA58B}\_Setup.dllFilesize
169KB
MD514615d42dc6cd9a024a685e25356048c
SHA15d6c45e35d0c5951ab75b7c121421d1ee91d733d
SHA256ec0265a1e752ed296e125645ea4c0097e4615a7e4c74ab5c520a2eb2ce2edaf5
SHA5129a99f6e70f752ac3c904aa05070f3cbe2825ee396b3b7b3cbbede3b19ac8e36b96311078e4a3fa4d65cb765c2a7e73035cfdfaeb4f85b1bec66416cc4045bc34
-
memory/1756-55-0x00000000763A1000-0x00000000763A3000-memory.dmpFilesize
8KB