9c1a447e31a10621396e06f4ed409aab0ab2dd753f6a3e0e7a6e0f1df7e596b3

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 15:31

Target

9c1a447e31a10621396e06f4ed409aab0ab2dd753f6a3e0e7a6e0f1df7e596b3.exe
Size

293KB
MD5

de347261de302fee3eadb1203023abb6
SHA1

acd6e6cee0981cbb917f2f84f42f3941998d7cf0
SHA256

9c1a447e31a10621396e06f4ed409aab0ab2dd753f6a3e0e7a6e0f1df7e596b3
SHA512

b8f543e6c8b867c3bb9c508b5c25aaf7e75469d5a4f3fce17bdfb780e268aa151c9ea4eb7e760796cb54291db8cab6c903e7daa5045944d6f2cd082e8fe97e9b
SSDEEP

6144:PrkH9uEo2S1YnQmCX492DkwNP3qpYFkSJEw8NFPbNeIfV+iqhwpCIoDQ:Prkdu6/eIo4/PPbNNfV+iUwpCP8

Score

7^/10

discovery

Loads dropped DLL 3 IoCs

pid	Process
532	9c1a447e31a10621396e06f4ed409aab0ab2dd753f6a3e0e7a6e0f1df7e596b3.exe
532	9c1a447e31a10621396e06f4ed409aab0ab2dd753f6a3e0e7a6e0f1df7e596b3.exe
532	9c1a447e31a10621396e06f4ed409aab0ab2dd753f6a3e0e7a6e0f1df7e596b3.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\9c1a447e31a10621396e06f4ed409aab0ab2dd753f6a3e0e7a6e0f1df7e596b3.exe
"C:\Users\Admin\AppData\Local\Temp\9c1a447e31a10621396e06f4ed409aab0ab2dd753f6a3e0e7a6e0f1df7e596b3.exe"
1⤵
- Loads dropped DLL
PID:532

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\TsuB3450DFA.dll

Filesize
269KB

MD5
af7ce801c8471c5cd19b366333c153c4

SHA1
4267749d020a362edbd25434ad65f98b073581f1

SHA256
cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

SHA512
88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

Download Submit
C:\Users\Admin\AppData\Local\Temp\{20938FAC-E53A-40FF-A214-AD18FB70AD5A}\Custom.dll

Filesize
66KB

MD5
da2373d58c5519642847863bb056d862

SHA1
6cf6e5b5757dec9763317a3e1c5326408c96ce86

SHA256
87d0622e84a8ef4777ff36e3804487e9aef738d4a91601d2a6608d59c91f9e3c

SHA512
f06f2931b7129bfbd813858c5ed02932de8388ee497cae97deab674739eb81ebde278c8f373780eed1cef9723b60747501ebb966d40e9b40c864b206490956b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\{20938FAC-E53A-40FF-A214-AD18FB70AD5A}\_Setup.dll

Filesize
160KB

MD5
3d99f53c75ee301fd7bc5abe8d883dbb

SHA1
35264d2ed3c675f152ac54045ce817693234fe06

SHA256
4ba7a5ffcfa4409eca57e201bedf9357d59a28bfd08b23081eb48f93ed8abea0

SHA512
a58054619c56b4dc1653876050a0b67df9bcffcf078b62f8cd88b96511a370e3ae9c67effc36d0b152eb5429f60eba52e5e58afca85a58527a3bf3600a89a42f

Download Submit