Analysis
-
max time kernel
41s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 04:08
Static task
static1
Behavioral task
behavioral1
Sample
3e62112e8c3105544f93ce7c34dabebf1b899e9fab69a4a5b7ba20e409c29659.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3e62112e8c3105544f93ce7c34dabebf1b899e9fab69a4a5b7ba20e409c29659.exe
Resource
win10v2004-20220812-en
General
-
Target
3e62112e8c3105544f93ce7c34dabebf1b899e9fab69a4a5b7ba20e409c29659.exe
-
Size
304KB
-
MD5
bc757ba1be7cb14035244ff1c1cfc509
-
SHA1
d21e05d82e24715a1b77f091fc1f649db69b95fc
-
SHA256
3e62112e8c3105544f93ce7c34dabebf1b899e9fab69a4a5b7ba20e409c29659
-
SHA512
870407d524652a61afdd7a3e4884573fc70bb13b1f02edf5a4fc427e7cd27a3c45a282e8f6b89af578d86394401280cb74fe8eaf0e35d7edb96cdbde1076538d
-
SSDEEP
6144:hrkx9uEo2S1YnQmCX492DkwNP3qpYFkXdlP5IO5/OoCVHuy6SHZ86riVZkiizP:hrkHu6/eIo4RXdrIO5/OpVHd6Ky6rizG
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
Processes:
3e62112e8c3105544f93ce7c34dabebf1b899e9fab69a4a5b7ba20e409c29659.exepid process 364 3e62112e8c3105544f93ce7c34dabebf1b899e9fab69a4a5b7ba20e409c29659.exe 364 3e62112e8c3105544f93ce7c34dabebf1b899e9fab69a4a5b7ba20e409c29659.exe 364 3e62112e8c3105544f93ce7c34dabebf1b899e9fab69a4a5b7ba20e409c29659.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
3e62112e8c3105544f93ce7c34dabebf1b899e9fab69a4a5b7ba20e409c29659.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 3e62112e8c3105544f93ce7c34dabebf1b899e9fab69a4a5b7ba20e409c29659.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum 3e62112e8c3105544f93ce7c34dabebf1b899e9fab69a4a5b7ba20e409c29659.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
3e62112e8c3105544f93ce7c34dabebf1b899e9fab69a4a5b7ba20e409c29659.exepid process 364 3e62112e8c3105544f93ce7c34dabebf1b899e9fab69a4a5b7ba20e409c29659.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e62112e8c3105544f93ce7c34dabebf1b899e9fab69a4a5b7ba20e409c29659.exe"C:\Users\Admin\AppData\Local\Temp\3e62112e8c3105544f93ce7c34dabebf1b899e9fab69a4a5b7ba20e409c29659.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:364
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\Tsu9D060083.dllFilesize
269KB
MD5af7ce801c8471c5cd19b366333c153c4
SHA14267749d020a362edbd25434ad65f98b073581f1
SHA256cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e
SHA51288655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c
-
\Users\Admin\AppData\Local\Temp\{37D29D57-E05D-4152-A3B9-A87FEC31BFA1}\Custom.dllFilesize
73KB
MD5e8d86c771d7e23b080921b9803f1654c
SHA149d8ef6835a6de734ead4e0b2cbbc65735cd5c17
SHA256cc7a340bffc39d8d8f704314f0383404590438b8cd16e780e0a26723bceedd21
SHA512b9902e0112bbf053ec4e3aa633ac2f2dd938b23507ff58ed69ac580656e42874c4b0ccb0d393b26637ae2b98feee78023d62378adb99140736e314de74fb399b
-
\Users\Admin\AppData\Local\Temp\{37D29D57-E05D-4152-A3B9-A87FEC31BFA1}\_Setup.dllFilesize
167KB
MD5262cc5a5e5a007ae182c45e41ac35adf
SHA1999582209e73d92d0040b8092666087aac2cee90
SHA256ecc186e0284593db51463f104ba8486b1de656d47a290d27c6fea157cb1495bd
SHA5122f59e23646774c3e5034d464242ac128cfb3ced1a0498dd0f719308b5854fbba20d457127e01b414f12b63d8bc3baf7ffcf89d91300ca43b90ed6cc933e4bd5b
-
memory/364-55-0x0000000075131000-0x0000000075133000-memory.dmpFilesize
8KB