967085c6e5df28bb3d9a1a6e2680423d38b8940b00a65b5407859f5d6aacfc7f

Analysis

max time kernel
289s
max time network
314s
platform
windows10-2004_x64
resource
win10v2004-20220812-es
resource tags

arch:x64arch:x86image:win10v2004-20220812-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
15-01-2023 23:31

Target

Prereqs/Visual C++ Redistributable for Visual Studio 2017.exe
Size

14.6MB
MD5

0af5748a2e790472af28e64105760eb7
SHA1

7ecf5797bc24eded2454aae6f3ca95c4f6eab807
SHA256

b192e143d55257a0a2f76be42e44ff8ee14014f3b1b196c6e59829b6b3ec453c
SHA512

9c3f6195477f836cdc948cfdb52f8e14b9b7ff9b59d036f6fe281d01d1cfcff53a7bed1c861f8e142a0060c5b8ee14d6df647f3de2181ac309da2863a21b92ce
SSDEEP

393216:lLlptVYmfr7yBG/4VgXR7hg7omRRjMW8Y6PJUA+bTqfQ89:lxpttD7yBG/zRKoOjvSUA+vqY89

Score

7^/10

discovery

Loads dropped DLL 1 IoCs

Processes:

Visual C++ Redistributable for Visual Studio 2017.exe

pid process

4364 Visual C++ Redistributable for Visual Studio 2017.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
4364	Visual C++ Redistributable for Visual Studio 2017.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Visual C++ Redistributable for Visual Studio 2017.exe

description	pid	process	target process
PID 4972 wrote to memory of 4364	4972	Visual C++ Redistributable for Visual Studio 2017.exe	Visual C++ Redistributable for Visual Studio 2017.exe
PID 4972 wrote to memory of 4364	4972	Visual C++ Redistributable for Visual Studio 2017.exe	Visual C++ Redistributable for Visual Studio 2017.exe
PID 4972 wrote to memory of 4364	4972	Visual C++ Redistributable for Visual Studio 2017.exe	Visual C++ Redistributable for Visual Studio 2017.exe

C:\Users\Admin\AppData\Local\Temp\Prereqs\Visual C++ Redistributable for Visual Studio 2017.exe
"C:\Users\Admin\AppData\Local\Temp\Prereqs\Visual C++ Redistributable for Visual Studio 2017.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4972

C:\Users\Admin\AppData\Local\Temp\Prereqs\Visual C++ Redistributable for Visual Studio 2017.exe
"C:\Users\Admin\AppData\Local\Temp\Prereqs\Visual C++ Redistributable for Visual Studio 2017.exe" -burn.unelevated BurnPipe.{D3E312FC-8D13-4DA7-8BA3-E6420D8CDA45} {4C5B9F44-1338-4D83-8262-44114E975CEB} 4972
2⤵
- Loads dropped DLL
PID:4364

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

C:\Users\Admin\AppData\Local\Temp\{fd9b6070-d13e-45dc-819b-41806bf45b6b}\.ba1\wixstdba.dll
Filesize
188KB

MD5
fb2c3564955853af5d9989ecce96bc26

SHA1
b53fce645ed8b7a80babe44c648df6473f3e2212

SHA256
6b5283b8bb18bc9349bba37c4d3bfe24fdae073636910bbbeba00e37242df078

SHA512
6daa89611880ea646630d104dfaf1454a6f8beefa0eb2259d5b4971a2ca6a3bbdbd0d9b4201d0a28860b1081655e1f867cda79c4285b5c96ea4d1e46e211166a

Download Submit
memory/4364-132-0x0000000000000000-mapping.dmp

Download