Analysis
-
max time kernel
217s -
max time network
282s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 06:52
Static task
static1
Behavioral task
behavioral1
Sample
e77d93874ff714020022a49009d4b7fc7e5d5b17d362cb7ec9cf794902ca2ee1.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e77d93874ff714020022a49009d4b7fc7e5d5b17d362cb7ec9cf794902ca2ee1.exe
Resource
win10v2004-20221111-en
General
-
Target
e77d93874ff714020022a49009d4b7fc7e5d5b17d362cb7ec9cf794902ca2ee1.exe
-
Size
752KB
-
MD5
2db82147bb17ce650b32551b3ede29cc
-
SHA1
54daaa1d1c08b5d8c1bbb4648e75b05cbe54e2c8
-
SHA256
e77d93874ff714020022a49009d4b7fc7e5d5b17d362cb7ec9cf794902ca2ee1
-
SHA512
48419612cc4dd39499c42707d91553c3273460f740e931627b5e1e8db534b625fdd8b70acef86fde72d5e4e2cc6d17a9241d026c5a015cda81e4e3c37039f04d
-
SSDEEP
12288:LCbXZYRqMT9mqG3g4wZG3xnkUTnFK05KLdblX77eBO5YKT1fz7RR4pXIaNRB:2bXZwd5mq94wZktKxblX7715YU1pqd
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1500-55-0x0000000000400000-0x0000000000613000-memory.dmp upx behavioral1/memory/1500-57-0x0000000000400000-0x0000000000613000-memory.dmp upx behavioral1/memory/1500-58-0x0000000000400000-0x0000000000613000-memory.dmp upx behavioral1/memory/1500-59-0x0000000000400000-0x0000000000613000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
e77d93874ff714020022a49009d4b7fc7e5d5b17d362cb7ec9cf794902ca2ee1.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run e77d93874ff714020022a49009d4b7fc7e5d5b17d362cb7ec9cf794902ca2ee1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SonyAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e77d93874ff714020022a49009d4b7fc7e5d5b17d362cb7ec9cf794902ca2ee1.exe" e77d93874ff714020022a49009d4b7fc7e5d5b17d362cb7ec9cf794902ca2ee1.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1500-54-0x0000000075151000-0x0000000075153000-memory.dmpFilesize
8KB
-
memory/1500-55-0x0000000000400000-0x0000000000613000-memory.dmpFilesize
2.1MB
-
memory/1500-57-0x0000000000400000-0x0000000000613000-memory.dmpFilesize
2.1MB
-
memory/1500-58-0x0000000000400000-0x0000000000613000-memory.dmpFilesize
2.1MB
-
memory/1500-59-0x0000000000400000-0x0000000000613000-memory.dmpFilesize
2.1MB