06fb5f8b5c42c35d87a1031cc7d25c630c6cf4380460307a5e027e61d1d33b02

Analysis

max time kernel
7s
max time network
36s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
26/05/2023, 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Pizza.Tower.v1.0.311/_Redist/_Redist/vcredist2015_2017_2019_x64.exe
Size

14.3MB
MD5

264c296cc0bf00db6ba8e7bf8cc4e706
SHA1

837a49f9eaacda7c077a8bbea149a52d766b81c0
SHA256

7d7105c52fcd6766beee1ae162aa81e278686122c1e44890712326634d0b055e
SHA512

9f197af069535896f866d2853689c8e0243fe5c89feeaf6a027315f31bb0086bb0a6234e77a4427481fb2dbe32c3c0d748f9de82ee439086745658a825bed5e9
SSDEEP

196608:bRjltflpQcIIS/Rj7BWl+aV8t8z72BxBwBgO4oDi08YfpPOx5l5xtc84s7uhzNIe:1LlptVYmfr7yBG/4oDd8DL4s7uhBqY

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
920	vcredist2015_2017_2019_x64.exe

Loads dropped DLL 2 IoCs

pid	Process
1716	vcredist2015_2017_2019_x64.exe
920	vcredist2015_2017_2019_x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 920	1716	vcredist2015_2017_2019_x64.exe	28
PID 1716 wrote to memory of 920	1716	vcredist2015_2017_2019_x64.exe	28
PID 1716 wrote to memory of 920	1716	vcredist2015_2017_2019_x64.exe	28
PID 1716 wrote to memory of 920	1716	vcredist2015_2017_2019_x64.exe	28
PID 1716 wrote to memory of 920	1716	vcredist2015_2017_2019_x64.exe	28
PID 1716 wrote to memory of 920	1716	vcredist2015_2017_2019_x64.exe	28
PID 1716 wrote to memory of 920	1716	vcredist2015_2017_2019_x64.exe	28

C:\Users\Admin\AppData\Local\Temp\Pizza.Tower.v1.0.311\_Redist\_Redist\vcredist2015_2017_2019_x64.exe
"C:\Users\Admin\AppData\Local\Temp\Pizza.Tower.v1.0.311\_Redist\_Redist\vcredist2015_2017_2019_x64.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\Temp\{BDFACC64-E95A-4B3E-9C12-B5DC2CED0480}\.cr\vcredist2015_2017_2019_x64.exe
  "C:\Windows\Temp\{BDFACC64-E95A-4B3E-9C12-B5DC2CED0480}\.cr\vcredist2015_2017_2019_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\Pizza.Tower.v1.0.311\_Redist\_Redist\vcredist2015_2017_2019_x64.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\{8B5F9A75-542C-40FC-AF53-C775A6A30EAC}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{BDFACC64-E95A-4B3E-9C12-B5DC2CED0480}\.cr\vcredist2015_2017_2019_x64.exe

Filesize
632KB

MD5
562711caf0d942d286fd28d34ebf9fdf

SHA1
001b037c732b497e390bd756901e64ce0d84d885

SHA256
3556010aa72b67d16dc6b406aecf493185c92f38ad410924959175fd39192b61

SHA512
447ea79c0fe30b5458d139d903bf738126c8159250a5b732ca9afdb7536be3ef5c81857852034fbdf385d9bbc43e1c77dc9618f7ad0b60ff3d9c526711c30060

Download Submit
C:\Windows\Temp\{BDFACC64-E95A-4B3E-9C12-B5DC2CED0480}\.cr\vcredist2015_2017_2019_x64.exe

Filesize
632KB

MD5
562711caf0d942d286fd28d34ebf9fdf

SHA1
001b037c732b497e390bd756901e64ce0d84d885

SHA256
3556010aa72b67d16dc6b406aecf493185c92f38ad410924959175fd39192b61

SHA512
447ea79c0fe30b5458d139d903bf738126c8159250a5b732ca9afdb7536be3ef5c81857852034fbdf385d9bbc43e1c77dc9618f7ad0b60ff3d9c526711c30060

Download Submit
\Windows\Temp\{8B5F9A75-542C-40FC-AF53-C775A6A30EAC}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
\Windows\Temp\{BDFACC64-E95A-4B3E-9C12-B5DC2CED0480}\.cr\vcredist2015_2017_2019_x64.exe

Filesize
632KB

MD5
562711caf0d942d286fd28d34ebf9fdf

SHA1
001b037c732b497e390bd756901e64ce0d84d885

SHA256
3556010aa72b67d16dc6b406aecf493185c92f38ad410924959175fd39192b61

SHA512
447ea79c0fe30b5458d139d903bf738126c8159250a5b732ca9afdb7536be3ef5c81857852034fbdf385d9bbc43e1c77dc9618f7ad0b60ff3d9c526711c30060

Download Submit