Analysis
-
max time kernel
23s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 08:42
Static task
static1
Behavioral task
behavioral1
Sample
1fb03529b94a8de3aef636c4e8e4c9001ba0965f5de069a99989471b76e17d1d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1fb03529b94a8de3aef636c4e8e4c9001ba0965f5de069a99989471b76e17d1d.exe
Resource
win10v2004-20220812-en
General
-
Target
1fb03529b94a8de3aef636c4e8e4c9001ba0965f5de069a99989471b76e17d1d.exe
-
Size
314KB
-
MD5
96ebb705a5521ef2090b7d647d921f6e
-
SHA1
0f9abb80de497a1b92cdfb8c46995a691572e27a
-
SHA256
1fb03529b94a8de3aef636c4e8e4c9001ba0965f5de069a99989471b76e17d1d
-
SHA512
245e6f0a7d6df19b673c9caa88ff4c490c51f5af580e9d460a183936ae1b299cb1b2a58fb33bc51cf7a2f381ede910bb800a7bf052f7eb60050cd3e096505828
-
SSDEEP
6144:br5bUzkuvcBYC47l2xGnV6OjJaV490B6lKPk3JDEbk0teSVtY:brqkuveY3RnV6c800oIpbv0SVtY
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
Processes:
1fb03529b94a8de3aef636c4e8e4c9001ba0965f5de069a99989471b76e17d1d.exepid process 1016 1fb03529b94a8de3aef636c4e8e4c9001ba0965f5de069a99989471b76e17d1d.exe 1016 1fb03529b94a8de3aef636c4e8e4c9001ba0965f5de069a99989471b76e17d1d.exe 1016 1fb03529b94a8de3aef636c4e8e4c9001ba0965f5de069a99989471b76e17d1d.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
1fb03529b94a8de3aef636c4e8e4c9001ba0965f5de069a99989471b76e17d1d.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 1fb03529b94a8de3aef636c4e8e4c9001ba0965f5de069a99989471b76e17d1d.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum 1fb03529b94a8de3aef636c4e8e4c9001ba0965f5de069a99989471b76e17d1d.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
1fb03529b94a8de3aef636c4e8e4c9001ba0965f5de069a99989471b76e17d1d.exepid process 1016 1fb03529b94a8de3aef636c4e8e4c9001ba0965f5de069a99989471b76e17d1d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fb03529b94a8de3aef636c4e8e4c9001ba0965f5de069a99989471b76e17d1d.exe"C:\Users\Admin\AppData\Local\Temp\1fb03529b94a8de3aef636c4e8e4c9001ba0965f5de069a99989471b76e17d1d.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\Tsu0F620C21.dllFilesize
269KB
MD5af7ce801c8471c5cd19b366333c153c4
SHA14267749d020a362edbd25434ad65f98b073581f1
SHA256cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e
SHA51288655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c
-
\Users\Admin\AppData\Local\Temp\{4CF0FE79-26BB-4B27-A9CC-6E999713DC8F}\Custom.dllFilesize
91KB
MD5a7245bbd05aa5bee1f34b4c4de90c672
SHA194a148f9b49af78576e9915ad143b17c1d5514e7
SHA2561f749e2a9a754223f0609a4c8c91af2f2771ed52dfd0680fc4ad3c91877c3bc8
SHA5129a395e62a2ab8d096d293eb8d5bc24b91debfc8efe394848dd020987937ea8922b41967cc38bf8f4f8af0c386f1d8c7e31432564146120643d83e33c1904ef8f
-
\Users\Admin\AppData\Local\Temp\{4CF0FE79-26BB-4B27-A9CC-6E999713DC8F}\_Setup.dllFilesize
173KB
MD5f5b9122162a09af65e175de7bfe9c3e8
SHA15456548923f763866aae993914b3c96f9f694bce
SHA256250d2be5a8eeef8d991fd5790e4b191c9fe1328739f5ded8920bf9aeae8b26db
SHA512154732149c7d72f32d5a42019221ddb85b996441d3d7793ec04ac21696d66e0186e2165c58901f13e07611366074a1e1dc7ee3e1f87df9eeffa3c402a9a2567f
-
memory/1016-55-0x0000000075F51000-0x0000000075F53000-memory.dmpFilesize
8KB