548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260

Analysis

max time kernel
31s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 15:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe
Size

3.3MB
MD5

221a71ddde12b86b2a1a2b3a63fd2280
SHA1

6553c87b19df0b79dc8008d157f3bcc5bde011c5
SHA256

548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260
SHA512

09515a5b7a6e7d5e6e4cd7fbbaa4bf70a0d71886ce754254f5146a7f9fb331fe663e9d42a0ef427c56de98b46ad4f0bacd05030429c8fac67ee09d676375170e
SSDEEP

49152:8aBfrnFxwuCpdg037hG1oLqZXCJAQ7eEgZkZBcePYDj9k3VGllCTTfb/JeSlFGqA:8aBnf0395LiAAdPSYlk3PTv3lFGqvY

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
1980	548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe
1980	548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe
952	WerFault.exe
952	WerFault.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 1 IoCs

pid	pid_target	Process	procid_target
952	1980	WerFault.exe	16

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1980	548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe
1980	548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe
1980	548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1980	548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe
1980	548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe
1980	548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe
1980	548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 952	1980	548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe	28
PID 1980 wrote to memory of 952	1980	548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe	28
PID 1980 wrote to memory of 952	1980	548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe	28
PID 1980 wrote to memory of 952	1980	548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe	28
PID 1980 wrote to memory of 952	1980	548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe	28
PID 1980 wrote to memory of 952	1980	548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe	28
PID 1980 wrote to memory of 952	1980	548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe	28

C:\Users\Admin\AppData\Local\Temp\548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe
"C:\Users\Admin\AppData\Local\Temp\548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 960
  2⤵
  - Loads dropped DLL
  - Program crash
  PID:952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\112605654910\LZMA.dll

Filesize
67KB

MD5
d0f2416807f04c559e6394a0a4c7f1d1

SHA1
7df43ffa3716156d282b1e37d12dd1122f0a762c

SHA256
0fe6a869cf220769a058f8d281f272ef72669e3587673e52b53f3f9650dcf1fc

SHA512
8199c967ad813216f2ef3094a7614c9ccc95d35a817fc685cb7823f36cc97f0279bddd0ec0bb8f07ee2445476aaea35548516841ee9cde53a8be395515457799

Download Submit
\Users\Admin\AppData\Local\Temp\112605654910\skinconfig\TongJICNZZ.dll

Filesize
71KB

MD5
40e3899b01616fcaa8f9a6653504dd8b

SHA1
d890396f782230078f0e19e8d7d91091c4d0a38b

SHA256
0728576d67e8522158549c819de8206dcb886f3ac2997d5a962449bf8b671090

SHA512
256a0d95d567708213980fc24a90ada673f9a3bc7692bf30147c42a11e4cf286ccb92de2f360d9056e80e170cbdc06f715676f6f7678743f3e86fa99eff4aa42

Download Submit
\Users\Admin\AppData\Local\Temp\112605654910\skinconfig\TongJICNZZ.dll

Filesize
71KB

MD5
40e3899b01616fcaa8f9a6653504dd8b

SHA1
d890396f782230078f0e19e8d7d91091c4d0a38b

SHA256
0728576d67e8522158549c819de8206dcb886f3ac2997d5a962449bf8b671090

SHA512
256a0d95d567708213980fc24a90ada673f9a3bc7692bf30147c42a11e4cf286ccb92de2f360d9056e80e170cbdc06f715676f6f7678743f3e86fa99eff4aa42

Download Submit
\Users\Admin\AppData\Local\Temp\112605654910\skinconfig\TongJICNZZ.dll

Filesize
71KB

MD5
40e3899b01616fcaa8f9a6653504dd8b

SHA1
d890396f782230078f0e19e8d7d91091c4d0a38b

SHA256
0728576d67e8522158549c819de8206dcb886f3ac2997d5a962449bf8b671090

SHA512
256a0d95d567708213980fc24a90ada673f9a3bc7692bf30147c42a11e4cf286ccb92de2f360d9056e80e170cbdc06f715676f6f7678743f3e86fa99eff4aa42

Download Submit
memory/1980-54-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download