12f5800824d9c8af75088da0c1e4285fcc24bf7f9c336c18b13130de8a0f72a7

Analysis

max time kernel
143s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 13:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22fee308fa69043764ccd662fc8daf26.exe
Size

313KB
MD5

22fee308fa69043764ccd662fc8daf26
SHA1

d83e50d9d4d493fb39f63dacc55b30cbf877ca84
SHA256

12f5800824d9c8af75088da0c1e4285fcc24bf7f9c336c18b13130de8a0f72a7
SHA512

5119874af7ee4dce4624018be4d4dff4010487c0cf7d4e71f9b96fd20b4dcf987e691c36a582831f501e5b0111dd9e1f725c735835712482febd36f749694356
SSDEEP

6144:frK9uEo2S1YnQmCX492DkwNP3qpYFtcM7dZssr+Ixf6LuDTKD2ay9KGYG0Lv:fryu6/eIo4vMResyEf0uP9d9UG0v

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2064	22fee308fa69043764ccd662fc8daf26.exe
2064	22fee308fa69043764ccd662fc8daf26.exe
2064	22fee308fa69043764ccd662fc8daf26.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	22fee308fa69043764ccd662fc8daf26.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	22fee308fa69043764ccd662fc8daf26.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2064	22fee308fa69043764ccd662fc8daf26.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2064	22fee308fa69043764ccd662fc8daf26.exe

C:\Users\Admin\AppData\Local\Temp\22fee308fa69043764ccd662fc8daf26.exe
"C:\Users\Admin\AppData\Local\Temp\22fee308fa69043764ccd662fc8daf26.exe"
1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Tsu47F1D0C2.dll

Filesize
155KB

MD5
edd4c64e8a4dd2ca146b558561f58bd8

SHA1
033def8cd4e2f2fb4b3d47f200db833b108f0ded

SHA256
775c77bbbb0f5b731c7298cc9afcd1a560a27b5db3c03cbaeb34d268ec8ae299

SHA512
d5add606c62d483a6162a6bc037f4243bc7458daf081fd8ae1405d31b1ee9c5a51876ac8904eadebd1f6473e2f0434c7063bb2ddb4dd7534c08948ce23e167dc

Download Submit
\Users\Admin\AppData\Local\Temp\{4DA64DEF-334C-4157-A3BC-7B6E96456F19}\Custom.dll

Filesize
91KB

MD5
c9d3d86ee95ae4d20c80de9ddaa8fa40

SHA1
5f0546ec86f3e27f0eec4d5d5451edc630907654

SHA256
b34ca5ec63459956e72289b6b1d85891377c4ef451b48f42d92ab7d1aad117a9

SHA512
ea895f339e31432497401782a17275cecda18286a158ad191dc1a5c2c3c541205c679689a74ff46c4e4861c7e6d87bf862e54049b419675cadaeea76c400b186

Download Submit
\Users\Admin\AppData\Local\Temp\{4DA64DEF-334C-4157-A3BC-7B6E96456F19}\_Setup.dll

Filesize
115KB

MD5
28503be1794a2c103066b0c7117da59b

SHA1
5c093128dcfffb327792b180ceca7054a06143eb

SHA256
94b5250df8c44585daca23c5d5ab25fd0cda64eddb8c3ecd73adf13dd4de0a0a

SHA512
33ffa6a1745ec2ba72836749c51bcadccacaab118ae193035d1f762ad606b8d5c4867c62e244554ab9c7e728ea1498ad855b054767c6ab30bbefd4597242185a

Download Submit