548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260

Analysis

max time kernel
92s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 15:54

Target

548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe
Size

3.3MB
MD5

221a71ddde12b86b2a1a2b3a63fd2280
SHA1

6553c87b19df0b79dc8008d157f3bcc5bde011c5
SHA256

548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260
SHA512

09515a5b7a6e7d5e6e4cd7fbbaa4bf70a0d71886ce754254f5146a7f9fb331fe663e9d42a0ef427c56de98b46ad4f0bacd05030429c8fac67ee09d676375170e
SSDEEP

49152:8aBfrnFxwuCpdg037hG1oLqZXCJAQ7eEgZkZBcePYDj9k3VGllCTTfb/JeSlFGqA:8aBnf0395LiAAdPSYlk3PTv3lFGqvY

Score

7^/10

discovery

Loads dropped DLL 2 IoCs

pid	Process
4308	548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe
4308	548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4652	4308	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of SetWindowsHookEx 4 IoCs

C:\Users\Admin\AppData\Local\Temp\548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe
"C:\Users\Admin\AppData\Local\Temp\548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 1384
  2⤵
  - Program crash
  PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4308 -ip 4308
1⤵
PID:1600

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\11260565604\LZMA.dll

Filesize
67KB

MD5
d0f2416807f04c559e6394a0a4c7f1d1

SHA1
7df43ffa3716156d282b1e37d12dd1122f0a762c

SHA256
0fe6a869cf220769a058f8d281f272ef72669e3587673e52b53f3f9650dcf1fc

SHA512
8199c967ad813216f2ef3094a7614c9ccc95d35a817fc685cb7823f36cc97f0279bddd0ec0bb8f07ee2445476aaea35548516841ee9cde53a8be395515457799

Download Submit
C:\Users\Admin\AppData\Local\Temp\11260565604\skinconfig\TongJICNZZ.dll

Filesize
71KB

MD5
40e3899b01616fcaa8f9a6653504dd8b

SHA1
d890396f782230078f0e19e8d7d91091c4d0a38b

SHA256
0728576d67e8522158549c819de8206dcb886f3ac2997d5a962449bf8b671090

SHA512
256a0d95d567708213980fc24a90ada673f9a3bc7692bf30147c42a11e4cf286ccb92de2f360d9056e80e170cbdc06f715676f6f7678743f3e86fa99eff4aa42

Download Submit