Analysis
-
max time kernel
90s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 15:38
Static task
static1
Behavioral task
behavioral1
Sample
dd6ed56287cd25d770aa1de2976a31b2d1065b18b661a0986ab6af4289230a09.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
dd6ed56287cd25d770aa1de2976a31b2d1065b18b661a0986ab6af4289230a09.exe
Resource
win10v2004-20220812-en
General
-
Target
dd6ed56287cd25d770aa1de2976a31b2d1065b18b661a0986ab6af4289230a09.exe
-
Size
120KB
-
MD5
6cb93379756e78187196bfaff65cbb50
-
SHA1
fab8576c9c70f753a32a565ebee60b10d2dac5b8
-
SHA256
dd6ed56287cd25d770aa1de2976a31b2d1065b18b661a0986ab6af4289230a09
-
SHA512
32e887a34f64a649a6587b4813378de6a4ef58f7bb9d737f39dc8f53beebdafd65c8f5b0e64ab53c0418124024fa98ea8d309eb47fd8690c85227c32bf0a4543
-
SSDEEP
3072:IvG7ySV7c2lCECtUeExLBwdJddCJHZlPD4Fx50BNrr5vR:IUc2xQSxydJzCJ5JcGrdR
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
dd6ed56287cd25d770aa1de2976a31b2d1065b18b661a0986ab6af4289230a09.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum dd6ed56287cd25d770aa1de2976a31b2d1065b18b661a0986ab6af4289230a09.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 dd6ed56287cd25d770aa1de2976a31b2d1065b18b661a0986ab6af4289230a09.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
dd6ed56287cd25d770aa1de2976a31b2d1065b18b661a0986ab6af4289230a09.exepid process 864 dd6ed56287cd25d770aa1de2976a31b2d1065b18b661a0986ab6af4289230a09.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
dd6ed56287cd25d770aa1de2976a31b2d1065b18b661a0986ab6af4289230a09.exedescription pid process target process PID 864 wrote to memory of 816 864 dd6ed56287cd25d770aa1de2976a31b2d1065b18b661a0986ab6af4289230a09.exe svchost.exe PID 864 wrote to memory of 816 864 dd6ed56287cd25d770aa1de2976a31b2d1065b18b661a0986ab6af4289230a09.exe svchost.exe PID 864 wrote to memory of 816 864 dd6ed56287cd25d770aa1de2976a31b2d1065b18b661a0986ab6af4289230a09.exe svchost.exe PID 864 wrote to memory of 816 864 dd6ed56287cd25d770aa1de2976a31b2d1065b18b661a0986ab6af4289230a09.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd6ed56287cd25d770aa1de2976a31b2d1065b18b661a0986ab6af4289230a09.exe"C:\Users\Admin\AppData\Local\Temp\dd6ed56287cd25d770aa1de2976a31b2d1065b18b661a0986ab6af4289230a09.exe"1⤵
- Maps connected drives based on registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵PID:816
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/816-59-0x0000000000000000-mapping.dmp
-
memory/816-61-0x0000000000080000-0x0000000000093000-memory.dmpFilesize
76KB
-
memory/816-62-0x0000000000020000-0x000000000002F000-memory.dmpFilesize
60KB
-
memory/864-54-0x0000000075141000-0x0000000075143000-memory.dmpFilesize
8KB
-
memory/864-55-0x0000000002010000-0x00000000020A5000-memory.dmpFilesize
596KB
-
memory/864-56-0x0000000000290000-0x000000000029F000-memory.dmpFilesize
60KB
-
memory/864-57-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/864-58-0x0000000000290000-0x000000000029F000-memory.dmpFilesize
60KB