Analysis
-
max time kernel
143s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 08:35
Static task
static1
Behavioral task
behavioral1
Sample
321a9607ee8a76fb73b5222f0b6684f35e5e92bf8a8675ba91d420cbd549a9e2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
321a9607ee8a76fb73b5222f0b6684f35e5e92bf8a8675ba91d420cbd549a9e2.exe
Resource
win10v2004-20220812-en
General
-
Target
321a9607ee8a76fb73b5222f0b6684f35e5e92bf8a8675ba91d420cbd549a9e2.exe
-
Size
322KB
-
MD5
e6607e0dbe7adb18650169cf447bff62
-
SHA1
a40a9c1dded74174fdadc36e292e897ecd85a1c4
-
SHA256
321a9607ee8a76fb73b5222f0b6684f35e5e92bf8a8675ba91d420cbd549a9e2
-
SHA512
3284cd9fd1fd20a582138a18a8c7cd0c135671c4857122bb2c3b9e839954e634b7be0e3e6201876be723f05914fdc4f16a98229f1c73bfe15c0feadfa3366b25
-
SSDEEP
6144:UrV79uEo2S1YnQmCX492DkwNP3qpYFwJDqdQvBkXerxKFeKABBd2USPu+NOzB:UrVxu6/eIo4njBDoFMBsclB
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
Processes:
321a9607ee8a76fb73b5222f0b6684f35e5e92bf8a8675ba91d420cbd549a9e2.exepid process 4516 321a9607ee8a76fb73b5222f0b6684f35e5e92bf8a8675ba91d420cbd549a9e2.exe 4516 321a9607ee8a76fb73b5222f0b6684f35e5e92bf8a8675ba91d420cbd549a9e2.exe 4516 321a9607ee8a76fb73b5222f0b6684f35e5e92bf8a8675ba91d420cbd549a9e2.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
321a9607ee8a76fb73b5222f0b6684f35e5e92bf8a8675ba91d420cbd549a9e2.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 321a9607ee8a76fb73b5222f0b6684f35e5e92bf8a8675ba91d420cbd549a9e2.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum 321a9607ee8a76fb73b5222f0b6684f35e5e92bf8a8675ba91d420cbd549a9e2.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
321a9607ee8a76fb73b5222f0b6684f35e5e92bf8a8675ba91d420cbd549a9e2.exepid process 4516 321a9607ee8a76fb73b5222f0b6684f35e5e92bf8a8675ba91d420cbd549a9e2.exe 4516 321a9607ee8a76fb73b5222f0b6684f35e5e92bf8a8675ba91d420cbd549a9e2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\321a9607ee8a76fb73b5222f0b6684f35e5e92bf8a8675ba91d420cbd549a9e2.exe"C:\Users\Admin\AppData\Local\Temp\321a9607ee8a76fb73b5222f0b6684f35e5e92bf8a8675ba91d420cbd549a9e2.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\TsuF027E8DE.dllFilesize
269KB
MD5af7ce801c8471c5cd19b366333c153c4
SHA14267749d020a362edbd25434ad65f98b073581f1
SHA256cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e
SHA51288655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c
-
C:\Users\Admin\AppData\Local\Temp\{AC950D90-9383-433C-A1D7-DBA177762F66}\Custom.dllFilesize
91KB
MD5396573acf88c363e3406677f3353d886
SHA195d078a2ff0eb1a884b932e08805cf178796b19b
SHA256e269f87987fb85313f0d1b276656020470b04e5e545784f5b3e03f9ca611b482
SHA512a5a0c72287044ebeba9ec45f46716592b945479a219b71a78e070f842a6d1c9c0c79d253946bf793b19b9dbbc2b05459ff7fdb0efaadc474c0b5190d828cc6b6
-
C:\Users\Admin\AppData\Local\Temp\{AC950D90-9383-433C-A1D7-DBA177762F66}\_Setup.dllFilesize
174KB
MD560a15ff723fa5d801aa3459c11267fd4
SHA115d3c6ded87fb2c402e0d88e32a439ba08537c4f
SHA2565426140e239fc68e5a7bbecd6bf8eed9ebda3a6274b68f4bcac49d0acdbede65
SHA512b705f46f1b5c82fc216003bd652d69741acb74b0de9a75b91e06ed0e5ece1207520d7d53927c02a21aa0e628f6e188d54482835ab00f50adf53ddd99ac531a78