Analysis
-
max time kernel
127s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 09:03
Static task
static1
Behavioral task
behavioral1
Sample
2128c88ff0dc4be26b27fc9650093af0c0bc70b45fc0e7898859cfb8cf8a1f93.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2128c88ff0dc4be26b27fc9650093af0c0bc70b45fc0e7898859cfb8cf8a1f93.exe
Resource
win10v2004-20221111-en
General
-
Target
2128c88ff0dc4be26b27fc9650093af0c0bc70b45fc0e7898859cfb8cf8a1f93.exe
-
Size
304KB
-
MD5
fd9f6d60ce2a22f17413be65678a3c9e
-
SHA1
80b6d17572ce6b1c6d7c999ebd785c9792a483c4
-
SHA256
2128c88ff0dc4be26b27fc9650093af0c0bc70b45fc0e7898859cfb8cf8a1f93
-
SHA512
9c747344105e3f435fc62c89e049943491e8463dba115237a8d20b65e8d0c813e13061a7ce9649fd56c03417ed4c147f319298bb763b357b48380a6449bf556d
-
SSDEEP
6144:Vrkx9uEo2S1YnQmCX492DkwNP3qpYFkXdlP5IO5/OoCVHuy6SHZ86riVZkiizI:VrkHu6/eIo4RXdrIO5/OpVHd6Ky6rizl
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
Processes:
2128c88ff0dc4be26b27fc9650093af0c0bc70b45fc0e7898859cfb8cf8a1f93.exepid process 1572 2128c88ff0dc4be26b27fc9650093af0c0bc70b45fc0e7898859cfb8cf8a1f93.exe 1572 2128c88ff0dc4be26b27fc9650093af0c0bc70b45fc0e7898859cfb8cf8a1f93.exe 1572 2128c88ff0dc4be26b27fc9650093af0c0bc70b45fc0e7898859cfb8cf8a1f93.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
2128c88ff0dc4be26b27fc9650093af0c0bc70b45fc0e7898859cfb8cf8a1f93.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2128c88ff0dc4be26b27fc9650093af0c0bc70b45fc0e7898859cfb8cf8a1f93.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum 2128c88ff0dc4be26b27fc9650093af0c0bc70b45fc0e7898859cfb8cf8a1f93.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
2128c88ff0dc4be26b27fc9650093af0c0bc70b45fc0e7898859cfb8cf8a1f93.exepid process 1572 2128c88ff0dc4be26b27fc9650093af0c0bc70b45fc0e7898859cfb8cf8a1f93.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2128c88ff0dc4be26b27fc9650093af0c0bc70b45fc0e7898859cfb8cf8a1f93.exe"C:\Users\Admin\AppData\Local\Temp\2128c88ff0dc4be26b27fc9650093af0c0bc70b45fc0e7898859cfb8cf8a1f93.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\Tsu1E367129.dllFilesize
269KB
MD5af7ce801c8471c5cd19b366333c153c4
SHA14267749d020a362edbd25434ad65f98b073581f1
SHA256cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e
SHA51288655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c
-
\Users\Admin\AppData\Local\Temp\{EEF23226-FB36-47D9-A532-B314351110D0}\Custom.dllFilesize
73KB
MD5e8d86c771d7e23b080921b9803f1654c
SHA149d8ef6835a6de734ead4e0b2cbbc65735cd5c17
SHA256cc7a340bffc39d8d8f704314f0383404590438b8cd16e780e0a26723bceedd21
SHA512b9902e0112bbf053ec4e3aa633ac2f2dd938b23507ff58ed69ac580656e42874c4b0ccb0d393b26637ae2b98feee78023d62378adb99140736e314de74fb399b
-
\Users\Admin\AppData\Local\Temp\{EEF23226-FB36-47D9-A532-B314351110D0}\_Setup.dllFilesize
167KB
MD5262cc5a5e5a007ae182c45e41ac35adf
SHA1999582209e73d92d0040b8092666087aac2cee90
SHA256ecc186e0284593db51463f104ba8486b1de656d47a290d27c6fea157cb1495bd
SHA5122f59e23646774c3e5034d464242ac128cfb3ced1a0498dd0f719308b5854fbba20d457127e01b414f12b63d8bc3baf7ffcf89d91300ca43b90ed6cc933e4bd5b
-
memory/1572-55-0x0000000076121000-0x0000000076123000-memory.dmpFilesize
8KB