d6d846ae3751495ef398ce5af5facfb460ec76b0cb02992905576542d6e548d7

Analysis

max time kernel
152s
max time network
156s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:48

Target

d6d846ae3751495ef398ce5af5facfb460ec76b0cb02992905576542d6e548d7.exe
Size

76KB
MD5

bb0b440cbac54114d04648be6f2fe26d
SHA1

bdc7c47001852a8e915f29eaebcf99ffa857c3b5
SHA256

d6d846ae3751495ef398ce5af5facfb460ec76b0cb02992905576542d6e548d7
SHA512

a4fff1a312add0cb1c3cb3ae52bc1ccbce0616453e9f3e9c10c1e631ef7b09503713ef7b922c127ebfd5b57d7315f03c1db42139300752dc22ce429b9a57993e
SSDEEP

1536:pV0nwVFqapIMn8v4YpZxGEN7LbeN7ILYOJcO+tfn:0wuapI0TYZ4N8L6Oqfn

Score

8^/10

discovery

Executes dropped EXE 1 IoCs

Processes:

edgFFB4.exe

pid process

804 edgFFB4.exe
Deletes itself 1 IoCs

Processes:

edgFFB4.exe

pid process

804 edgFFB4.exe

pid	process
804	edgFFB4.exe

pid	process
804	edgFFB4.exe

Loads dropped DLL 2 IoCs

Processes:

d6d846ae3751495ef398ce5af5facfb460ec76b0cb02992905576542d6e548d7.exe

pid	process
1052	d6d846ae3751495ef398ce5af5facfb460ec76b0cb02992905576542d6e548d7.exe
1052	d6d846ae3751495ef398ce5af5facfb460ec76b0cb02992905576542d6e548d7.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d6d846ae3751495ef398ce5af5facfb460ec76b0cb02992905576542d6e548d7.exe

description	pid	process	target process
PID 1052 wrote to memory of 804	1052	d6d846ae3751495ef398ce5af5facfb460ec76b0cb02992905576542d6e548d7.exe	edgFFB4.exe
PID 1052 wrote to memory of 804	1052	d6d846ae3751495ef398ce5af5facfb460ec76b0cb02992905576542d6e548d7.exe	edgFFB4.exe
PID 1052 wrote to memory of 804	1052	d6d846ae3751495ef398ce5af5facfb460ec76b0cb02992905576542d6e548d7.exe	edgFFB4.exe
PID 1052 wrote to memory of 804	1052	d6d846ae3751495ef398ce5af5facfb460ec76b0cb02992905576542d6e548d7.exe	edgFFB4.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\edgFFB4.exe

Filesize
76KB

MD5
7070777c5f77b4369ad2dd15cadfa06e

SHA1
b4f4b426457124ecfeec4d5b59b9c2a6c25baaf7

SHA256
3e7468fd4ced8ff1bf5d6257beb8498ce7c52511256d62514de4e65e4b771dfd

SHA512
20545a4586fbd35c66951f04f29495cf6ce2b73b5f02f66f34ae95b58ba3dbdc3a1816643b6cb891acc98ce0a268b5fff6e6ba5c827c30a1a862a51067b3afa0

Download Submit
\Users\Admin\AppData\Local\edgFFB4.exe

Filesize
76KB

MD5
7070777c5f77b4369ad2dd15cadfa06e

SHA1
b4f4b426457124ecfeec4d5b59b9c2a6c25baaf7

SHA256
3e7468fd4ced8ff1bf5d6257beb8498ce7c52511256d62514de4e65e4b771dfd

SHA512
20545a4586fbd35c66951f04f29495cf6ce2b73b5f02f66f34ae95b58ba3dbdc3a1816643b6cb891acc98ce0a268b5fff6e6ba5c827c30a1a862a51067b3afa0

Download Submit
\Users\Admin\AppData\Local\edgFFB4.exe

Filesize
76KB

MD5
7070777c5f77b4369ad2dd15cadfa06e

SHA1
b4f4b426457124ecfeec4d5b59b9c2a6c25baaf7

SHA256
3e7468fd4ced8ff1bf5d6257beb8498ce7c52511256d62514de4e65e4b771dfd

SHA512
20545a4586fbd35c66951f04f29495cf6ce2b73b5f02f66f34ae95b58ba3dbdc3a1816643b6cb891acc98ce0a268b5fff6e6ba5c827c30a1a862a51067b3afa0

Download Submit
memory/804-63-0x0000000000000000-mapping.dmp

Download
memory/1052-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1052-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download