Analysis
-
max time kernel
305s -
max time network
369s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 09:04
Static task
static1
Behavioral task
behavioral1
Sample
0916e82e6e6fe8bad574b4ec7cc71e46dba206a503deb101fc60a7ed9be8b684.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
0916e82e6e6fe8bad574b4ec7cc71e46dba206a503deb101fc60a7ed9be8b684.exe
Resource
win10v2004-20221111-en
General
-
Target
0916e82e6e6fe8bad574b4ec7cc71e46dba206a503deb101fc60a7ed9be8b684.exe
-
Size
304KB
-
MD5
d95ed89f3ade649cd06f473a1f1ba006
-
SHA1
74d5b0bbbc72efbbe35b3fedf8f308c3f8d4f7a6
-
SHA256
0916e82e6e6fe8bad574b4ec7cc71e46dba206a503deb101fc60a7ed9be8b684
-
SHA512
d46cf352ae53977bfc389167bda2d11b673d3f543822ee08806491853a67e6bed3f10075e9d5d2e7cc929c0645d0eae56761e114a7e4d11ab69a1840e4ddc351
-
SSDEEP
6144:lrkx9uEo2S1YnQmCX492DkwNP3qpYFkXdlP5IO5/OoCVHuy6SHZ86riVZkiizd:lrkHu6/eIo4RXdrIO5/OpVHd6Ky6rizE
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
Processes:
0916e82e6e6fe8bad574b4ec7cc71e46dba206a503deb101fc60a7ed9be8b684.exepid process 2656 0916e82e6e6fe8bad574b4ec7cc71e46dba206a503deb101fc60a7ed9be8b684.exe 2656 0916e82e6e6fe8bad574b4ec7cc71e46dba206a503deb101fc60a7ed9be8b684.exe 2656 0916e82e6e6fe8bad574b4ec7cc71e46dba206a503deb101fc60a7ed9be8b684.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
0916e82e6e6fe8bad574b4ec7cc71e46dba206a503deb101fc60a7ed9be8b684.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 0916e82e6e6fe8bad574b4ec7cc71e46dba206a503deb101fc60a7ed9be8b684.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum 0916e82e6e6fe8bad574b4ec7cc71e46dba206a503deb101fc60a7ed9be8b684.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
0916e82e6e6fe8bad574b4ec7cc71e46dba206a503deb101fc60a7ed9be8b684.exepid process 2656 0916e82e6e6fe8bad574b4ec7cc71e46dba206a503deb101fc60a7ed9be8b684.exe 2656 0916e82e6e6fe8bad574b4ec7cc71e46dba206a503deb101fc60a7ed9be8b684.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0916e82e6e6fe8bad574b4ec7cc71e46dba206a503deb101fc60a7ed9be8b684.exe"C:\Users\Admin\AppData\Local\Temp\0916e82e6e6fe8bad574b4ec7cc71e46dba206a503deb101fc60a7ed9be8b684.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Tsu8248DE70.dllFilesize
269KB
MD5af7ce801c8471c5cd19b366333c153c4
SHA14267749d020a362edbd25434ad65f98b073581f1
SHA256cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e
SHA51288655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c
-
C:\Users\Admin\AppData\Local\Temp\{4FA3E86E-716F-4F88-AD63-394D9440CA98}\Custom.dllFilesize
73KB
MD5e8d86c771d7e23b080921b9803f1654c
SHA149d8ef6835a6de734ead4e0b2cbbc65735cd5c17
SHA256cc7a340bffc39d8d8f704314f0383404590438b8cd16e780e0a26723bceedd21
SHA512b9902e0112bbf053ec4e3aa633ac2f2dd938b23507ff58ed69ac580656e42874c4b0ccb0d393b26637ae2b98feee78023d62378adb99140736e314de74fb399b
-
C:\Users\Admin\AppData\Local\Temp\{4FA3E86E-716F-4F88-AD63-394D9440CA98}\_Setup.dllFilesize
167KB
MD5262cc5a5e5a007ae182c45e41ac35adf
SHA1999582209e73d92d0040b8092666087aac2cee90
SHA256ecc186e0284593db51463f104ba8486b1de656d47a290d27c6fea157cb1495bd
SHA5122f59e23646774c3e5034d464242ac128cfb3ced1a0498dd0f719308b5854fbba20d457127e01b414f12b63d8bc3baf7ffcf89d91300ca43b90ed6cc933e4bd5b