2276a964aea8abc6033b763d7546291a5ff48f30df01cd57b1a8b2c0dbbdd6a3

Analysis

max time kernel
79s
max time network
64s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 18:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

34e3d80893618ba4e68f081c4b4fd46e.exe
Size

313KB
MD5

34e3d80893618ba4e68f081c4b4fd46e
SHA1

232f06dcb6142260febf5a6efcbd7f01f5a2acac
SHA256

2276a964aea8abc6033b763d7546291a5ff48f30df01cd57b1a8b2c0dbbdd6a3
SHA512

b46da3f58e034f224ed002fa87ee822e2f0b2c9ef771ec117ca2486979ce4e3c0aa59a30cb792150f7a5f4117d7c340bafed3412fd088dd3dcf0b215f2e2a0f7
SSDEEP

6144:/rb9uEo2S1YnQmCX492DkwNP3qpYFl2YyPuFITzyccux7rnrOzprCoM8:/rRu6/eIo4t3PuFITKUAn

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
464	34e3d80893618ba4e68f081c4b4fd46e.exe
464	34e3d80893618ba4e68f081c4b4fd46e.exe
464	34e3d80893618ba4e68f081c4b4fd46e.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	34e3d80893618ba4e68f081c4b4fd46e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	34e3d80893618ba4e68f081c4b4fd46e.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
464	34e3d80893618ba4e68f081c4b4fd46e.exe
464	34e3d80893618ba4e68f081c4b4fd46e.exe

C:\Users\Admin\AppData\Local\Temp\34e3d80893618ba4e68f081c4b4fd46e.exe
"C:\Users\Admin\AppData\Local\Temp\34e3d80893618ba4e68f081c4b4fd46e.exe"
1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Tsu85663120.dll

Filesize
95KB

MD5
1fdbe0cb7d2439e2170127e6412d9d63

SHA1
626d2ecbfca259384e91cbf412febe5838b5bcfa

SHA256
16ad6a211f19f22db23312074a7603bc209d2915cd5cf50791356353694a021e

SHA512
299610e0cbcc5e9c2b34f4bd54834163adb066af79f8cafae6e7f23b29135232af34c7efd31c4c4dab7c1cdc9ddc1840a0ce4555c568893bf0492aa147e2e250

Download Submit