Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 16:41
Static task
static1
Behavioral task
behavioral1
Sample
e1a42e9542fa855410ae940fe97b483279573fd1f262bd6e4f511d372c99b5af.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e1a42e9542fa855410ae940fe97b483279573fd1f262bd6e4f511d372c99b5af.exe
Resource
win10v2004-20220901-en
General
-
Target
e1a42e9542fa855410ae940fe97b483279573fd1f262bd6e4f511d372c99b5af.exe
-
Size
825KB
-
MD5
67d127099bdf2a91016f0b7847accd61
-
SHA1
8fe89b14f909c7a95b6af42f95a1d4b7253189b5
-
SHA256
e1a42e9542fa855410ae940fe97b483279573fd1f262bd6e4f511d372c99b5af
-
SHA512
55b6ca0c49bd12b819e098fb439739d930544fb3650e010de9011c16f2d9f066e5d415af7d9bf9f10dbebb6d959169107aae0648a76c88775c2859dfd2210e2f
-
SSDEEP
24576:x49PQC6JhIkcX/vYiMfcOI4SdCVBudS9K4aV8qddrf6lu:C/SPwvkkOI4sroKf7Al
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1424-58-0x0000000000C60000-0x0000000000E93000-memory.dmp upx behavioral1/memory/1424-59-0x0000000000C60000-0x0000000000E93000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run e1a42e9542fa855410ae940fe97b483279573fd1f262bd6e4f511d372c99b5af.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SonyAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e1a42e9542fa855410ae940fe97b483279573fd1f262bd6e4f511d372c99b5af.exe" e1a42e9542fa855410ae940fe97b483279573fd1f262bd6e4f511d372c99b5af.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.