bced812112439dc85b04747045a0a19ee4b6d9f9ca0b378390e41379ffdb9f9d

Analysis

max time kernel
301s
max time network
275s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2023 12:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PvZ_Tools_v2.7.3/vc_redist.x86.exe
Size

13.1MB
MD5

dd0232ee751164eaad2fe0de7158d77d
SHA1

7391663f07cba7c99f3503929fcd3561f1f6a552
SHA256

4c6c420cf4cbf2c9c9ed476e96580ae92a97b2822c21329a2e49e8439ac5ad30
SHA512

cc82a7a8ead3c036559109d4daee623622edd4b4b5241545efa0e36d906c1af10d4056ad003f8849475f4e1e625eb9f27de7a9e13b28ac7ab88da99d5f926c2e
SSDEEP

393216:eEHMlptVYmfr7yBG/4u1ma3R9kCX83LHqD:eeApttD7yBG/Fm8Hg2D

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

vc_redist.x86.exe

pid process

4484 vc_redist.x86.exe
Loads dropped DLL 1 IoCs

Processes:

vc_redist.x86.exe

pid process

4484 vc_redist.x86.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
4484	vc_redist.x86.exe

pid	process
4484	vc_redist.x86.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

vc_redist.x86.exe

description	pid	process	target process
PID 1744 wrote to memory of 4484	1744	vc_redist.x86.exe	vc_redist.x86.exe
PID 1744 wrote to memory of 4484	1744	vc_redist.x86.exe	vc_redist.x86.exe
PID 1744 wrote to memory of 4484	1744	vc_redist.x86.exe	vc_redist.x86.exe

C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.3\vc_redist.x86.exe
"C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.3\vc_redist.x86.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\Temp\{000957DD-94C7-47E4-903F-6CD4F09ADE5E}\.cr\vc_redist.x86.exe
"C:\Windows\Temp\{000957DD-94C7-47E4-903F-6CD4F09ADE5E}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.3\vc_redist.x86.exe" -burn.filehandle.attached=656 -burn.filehandle.self=540
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4484

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\{000957DD-94C7-47E4-903F-6CD4F09ADE5E}\.cr\vc_redist.x86.exe
Filesize
632KB

MD5
29c7a21bae42889b08137c25aae8e55c

SHA1
d5cd79ca094c60f64ef7d9069e24270cee24b4ea

SHA256
82612a2fa05d62929833052ce76788b98701f0c19dca313923452afec44edec5

SHA512
484ecdda526b95d0fd062a2b24be537dd6c5a5945441de250cbe2419b98041625505fa51202735cb6054db444dc1f4bbf0b0e51588500ab89d54d7addca5e2d6

Download Submit
C:\Windows\Temp\{000957DD-94C7-47E4-903F-6CD4F09ADE5E}\.cr\vc_redist.x86.exe
Filesize
632KB

MD5
29c7a21bae42889b08137c25aae8e55c

SHA1
d5cd79ca094c60f64ef7d9069e24270cee24b4ea

SHA256
82612a2fa05d62929833052ce76788b98701f0c19dca313923452afec44edec5

SHA512
484ecdda526b95d0fd062a2b24be537dd6c5a5945441de250cbe2419b98041625505fa51202735cb6054db444dc1f4bbf0b0e51588500ab89d54d7addca5e2d6

Download Submit
C:\Windows\Temp\{B0D6E841-58AD-4C75-B6E2-CCE8E91DEE6E}\.ba\logo.png
Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{B0D6E841-58AD-4C75-B6E2-CCE8E91DEE6E}\.ba\wixstdba.dll
Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit