8c19235f9fd51e46b02ca9b3ee8862ac0f74ebffdcf3a56f08729c93a81f769d

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 15:53

Target

8c19235f9fd51e46b02ca9b3ee8862ac0f74ebffdcf3a56f08729c93a81f769d.exe
Size

293KB
MD5

407582fd8dc09981219615d884551cde
SHA1

2d97016a63f8f55395ff103d8d8215442c39b095
SHA256

8c19235f9fd51e46b02ca9b3ee8862ac0f74ebffdcf3a56f08729c93a81f769d
SHA512

7eca8fb153f250e82281fe81be7aff719cc50a8f65b9765146947c54feab831204eabceedf0080c00d23e4d81bd678d3bdb7f7176531031e1c9a09e8b3f8f1a1
SSDEEP

6144:grk29uEo2S1YnQmCX492DkwNP3qpYF2hVIPo+BjmKUyQgSTHCG8Dr9AJl:grkOu6/eIo4kT6FycHCGKAn

Score

7^/10

discovery

Loads dropped DLL 3 IoCs

pid	Process
4664	8c19235f9fd51e46b02ca9b3ee8862ac0f74ebffdcf3a56f08729c93a81f769d.exe
4664	8c19235f9fd51e46b02ca9b3ee8862ac0f74ebffdcf3a56f08729c93a81f769d.exe
4664	8c19235f9fd51e46b02ca9b3ee8862ac0f74ebffdcf3a56f08729c93a81f769d.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8c19235f9fd51e46b02ca9b3ee8862ac0f74ebffdcf3a56f08729c93a81f769d.exe
"C:\Users\Admin\AppData\Local\Temp\8c19235f9fd51e46b02ca9b3ee8862ac0f74ebffdcf3a56f08729c93a81f769d.exe"
1⤵
- Loads dropped DLL
PID:4664

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\Tsu143C53E3.dll

Filesize
269KB

MD5
af7ce801c8471c5cd19b366333c153c4

SHA1
4267749d020a362edbd25434ad65f98b073581f1

SHA256
cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

SHA512
88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

Download Submit
C:\Users\Admin\AppData\Local\Temp\{67579265-4158-48E0-AA0B-097ABCB4B093}\Custom.dll

Filesize
66KB

MD5
d53cae5f680dd2ed181af7d33d8cc8b6

SHA1
c1de9522515ae41b299689eba12fa09192c4a3c5

SHA256
39856115698ed45b91184f18c1343d370ed1a214b008dc13d5a132f8b461e9b7

SHA512
c04306f033f50da600cd446505557aba870a11e979d5aae214361360b5043d7df9d0b3b1da0fe3ac45cec006aec52ff3bbe6c0d08ca8090294d2c369a75c97ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\{67579265-4158-48E0-AA0B-097ABCB4B093}\_Setup.dll

Filesize
160KB

MD5
3d99f53c75ee301fd7bc5abe8d883dbb

SHA1
35264d2ed3c675f152ac54045ce817693234fe06

SHA256
4ba7a5ffcfa4409eca57e201bedf9357d59a28bfd08b23081eb48f93ed8abea0

SHA512
a58054619c56b4dc1653876050a0b67df9bcffcf078b62f8cd88b96511a370e3ae9c67effc36d0b152eb5429f60eba52e5e58afca85a58527a3bf3600a89a42f

Download Submit