8ae59d82845159db3a70763f5cb1571e45ebf6a1adfecc47574ba17b019483a0

Analysis

max time kernel
119s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2023, 05:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VC_redist.x86.exe
Size

13.2MB
MD5

ca8c521c30f57c0c199d526b9a23fc4a
SHA1

663399541a7d3bb1b5ea0e57a00c024e50d8506c
SHA256

8ae59d82845159db3a70763f5cb1571e45ebf6a1adfecc47574ba17b019483a0
SHA512

28cf976fa51e4c7abb57fd8fcde6381f1e140407924ef265fde6e59546fb6fdeb803f388a5d1e9e74fb80d47ce5fd9f275aaf41258a09002fba27c2cbbc2df4d
SSDEEP

393216:S1HnlptVYmfr7yBG/4VpFu0qDrRE98MGlS:S5lpttD7yBG/oM1E9RGI

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2364	VC_redist.x86.exe

Loads dropped DLL 1 IoCs

pid	Process
2364	VC_redist.x86.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 2364	3948	VC_redist.x86.exe	85
PID 3948 wrote to memory of 2364	3948	VC_redist.x86.exe	85
PID 3948 wrote to memory of 2364	3948	VC_redist.x86.exe	85

C:\Users\Admin\AppData\Local\Temp\VC_redist.x86.exe
"C:\Users\Admin\AppData\Local\Temp\VC_redist.x86.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Windows\Temp\{FC197BF3-EC07-4355-BBF1-1E97FB7E7C74}\.cr\VC_redist.x86.exe
  "C:\Windows\Temp\{FC197BF3-EC07-4355-BBF1-1E97FB7E7C74}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\VC_redist.x86.exe" -burn.filehandle.attached=532 -burn.filehandle.self=540
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2364

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\{EE88DDC6-416D-4CFF-A497-1EF476E91DD6}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{EE88DDC6-416D-4CFF-A497-1EF476E91DD6}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{FC197BF3-EC07-4355-BBF1-1E97FB7E7C74}\.cr\VC_redist.x86.exe

Filesize
634KB

MD5
2389d29f633df11642dff1bf5f21eb35

SHA1
ce85460fd7cde25528142f4cdca4e6013bb4b1e8

SHA256
ab91fbaab09a94839ba839275338ac42fe2661781d371e517f9b2e4866e2cc55

SHA512
59d607112566d13d15a8de8e18be204e8bf0d2010310ebc9c8589ceb42fb8fce7800a6e58f30ffb92d4c1b3e0d17c1a2076a478de753e5334971465c52f8eeed

Download Submit
C:\Windows\Temp\{FC197BF3-EC07-4355-BBF1-1E97FB7E7C74}\.cr\VC_redist.x86.exe

Filesize
634KB

MD5
2389d29f633df11642dff1bf5f21eb35

SHA1
ce85460fd7cde25528142f4cdca4e6013bb4b1e8

SHA256
ab91fbaab09a94839ba839275338ac42fe2661781d371e517f9b2e4866e2cc55

SHA512
59d607112566d13d15a8de8e18be204e8bf0d2010310ebc9c8589ceb42fb8fce7800a6e58f30ffb92d4c1b3e0d17c1a2076a478de753e5334971465c52f8eeed

Download Submit