Analysis
-
max time kernel
278s -
max time network
308s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 23:04
Static task
static1
Behavioral task
behavioral1
Sample
552a762da1fbb301948b2495d594ee7329181ff2f230f2def1140ff05b426c0e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
552a762da1fbb301948b2495d594ee7329181ff2f230f2def1140ff05b426c0e.exe
Resource
win10v2004-20221111-en
General
-
Target
552a762da1fbb301948b2495d594ee7329181ff2f230f2def1140ff05b426c0e.exe
-
Size
92KB
-
MD5
84593b1faf3fd1b1b06ad6c626037633
-
SHA1
3ca61c457df216a5a3ca4b0a088039785cdef7a9
-
SHA256
552a762da1fbb301948b2495d594ee7329181ff2f230f2def1140ff05b426c0e
-
SHA512
1b036d117dcc7c90e318f48f1db219be750d9444da6666a089c3daca8c11b59007c8f9b3c9ca05869457fea87384f808513d2102a75d6c558e058aa2f274460b
-
SSDEEP
1536:Dv+vzSjbJ2F/bJKqOBGpBZ6E1EZ2SsNqTyraNUsdo4zgir6vpAl:ivzCcFTJK5BG2Z2LNqWoUdpAl
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
552a762da1fbb301948b2495d594ee7329181ff2f230f2def1140ff05b426c0e.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{7M8A6G00-3I18-11C0-821H-444200140P0S} 552a762da1fbb301948b2495d594ee7329181ff2f230f2def1140ff05b426c0e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7M8A6G00-3I18-11C0-821H-444200140P0S}\StubPath = "C:\\Windows\\system32\\OLE32Init.exe" 552a762da1fbb301948b2495d594ee7329181ff2f230f2def1140ff05b426c0e.exe -
Drops file in System32 directory 2 IoCs
Processes:
552a762da1fbb301948b2495d594ee7329181ff2f230f2def1140ff05b426c0e.exedescription ioc process File opened for modification C:\Windows\SysWOW64\OLE32Init.exe 552a762da1fbb301948b2495d594ee7329181ff2f230f2def1140ff05b426c0e.exe File created C:\Windows\SysWOW64\OLE32Init.exe 552a762da1fbb301948b2495d594ee7329181ff2f230f2def1140ff05b426c0e.exe -
Drops file in Windows directory 2 IoCs
Processes:
552a762da1fbb301948b2495d594ee7329181ff2f230f2def1140ff05b426c0e.exedescription ioc process File opened for modification C:\Windows\regsvr32.exe 552a762da1fbb301948b2495d594ee7329181ff2f230f2def1140ff05b426c0e.exe File created C:\Windows\regsvr32.exe 552a762da1fbb301948b2495d594ee7329181ff2f230f2def1140ff05b426c0e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\552a762da1fbb301948b2495d594ee7329181ff2f230f2def1140ff05b426c0e.exe"C:\Users\Admin\AppData\Local\Temp\552a762da1fbb301948b2495d594ee7329181ff2f230f2def1140ff05b426c0e.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in System32 directory
- Drops file in Windows directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3848-132-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB