Analysis
-
max time kernel
118s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 01:48
Static task
static1
Behavioral task
behavioral1
Sample
4a6f1cf3f6a50684053f294d2615b9a8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4a6f1cf3f6a50684053f294d2615b9a8.exe
Resource
win10v2004-20231215-en
General
-
Target
4a6f1cf3f6a50684053f294d2615b9a8.exe
-
Size
313KB
-
MD5
4a6f1cf3f6a50684053f294d2615b9a8
-
SHA1
1b9e966f7f3551a1a697af7fc18a5d472eb9dcc7
-
SHA256
20432ffb94837659a5e778c0588008e514b31bed9f757b3d354ba506cc351068
-
SHA512
2dacfd45cb14f467c54a7286cfcc8f4795557cc822d684d20c5b758e89bf3f359b698c9b6921045d57e2771fb9e74c86eb26e6f027c1642ba1743cb734ab8c24
-
SSDEEP
6144:orJ9uEo2S1YnQmCX492DkwNP3qpYFQiY0Z56GICaNRCVEumbcF6ov5d889PgLVDZ:orfu6/eIo4jVW5soVCcQovoO0DJM+E2
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 2160 4a6f1cf3f6a50684053f294d2615b9a8.exe 2160 4a6f1cf3f6a50684053f294d2615b9a8.exe 2160 4a6f1cf3f6a50684053f294d2615b9a8.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 4a6f1cf3f6a50684053f294d2615b9a8.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum 4a6f1cf3f6a50684053f294d2615b9a8.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2160 4a6f1cf3f6a50684053f294d2615b9a8.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2160 wrote to memory of 2652 2160 4a6f1cf3f6a50684053f294d2615b9a8.exe 32 PID 2160 wrote to memory of 2652 2160 4a6f1cf3f6a50684053f294d2615b9a8.exe 32 PID 2160 wrote to memory of 2652 2160 4a6f1cf3f6a50684053f294d2615b9a8.exe 32 PID 2160 wrote to memory of 2652 2160 4a6f1cf3f6a50684053f294d2615b9a8.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a6f1cf3f6a50684053f294d2615b9a8.exe"C:\Users\Admin\AppData\Local\Temp\4a6f1cf3f6a50684053f294d2615b9a8.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tin34ED.bat"2⤵PID:2652
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
834B
MD5edccdac1fc91eccd9221b8cf0894ae91
SHA1868c55c8d35ef81162205cbd41e4d55625b4df4e
SHA256a5aa91eee67be561c5f5b8fbf9327e68c7f9e7a898f98a9670f7570145e1fdb0
SHA51216fbc547ca5d44e76b6cec7133f3ebbfdc754a403d15ccd217e3bbca0e5ed9ed2955ead0034a2c91c8b3473d28358531ad97ab3ef1f36c5c282177ad88913564
-
Filesize
50B
MD55b07aea7a38c59be2959d75f0547b803
SHA1d02b92e51230df3ef2a074c1187bcfbddf072846
SHA256301ba06aa7c527a34fec5461a61397965cdaf04e2b942b9601fc6570dc0051d6
SHA51241a8c2bfcb2f5da5602fccb7875ea6069fb161535cc45a4ef437212d4b0f63f5f84e700a4fb8f71bcb717b8c5348405e8bf63f64a33005b90b4c969417ff1406
-
Filesize
2KB
MD57992e88b2763c99c24416d6ebce88122
SHA10574110d8032aa337c4cbb0837ecca40e187d883
SHA2568e72c04f8b95fe2af21a350739461527136b17730059722ed85a2b73b7df1538
SHA51268aa293d6ee68ce5605490304a37cfda8abf5b4e8362946d492abb879773d79824519cf73368a01c13fea4eecf46f3e4e5afe0fea44bd56288b6379dcf6a25c2
-
Filesize
15KB
MD5e717f6ce3a7429bfa6d7f3cf66737a4b
SHA101f4042589b4ed88c351ffeac256be7a9d884818
SHA2567be720a73ba8b084702c89f64a9b295fad92545d6ba781072cc056823f9a7633
SHA51265a9a27430811aa01b55cf365f8b7b9f03e70d32ec60e0706242bc568242bcd493999dc1b02d92bf0d01c0095c8c38d30f282a998cafb80e60ad07e0d875ce80
-
Filesize
4KB
MD5e1d796d68cef7297976b889df8327a24
SHA1379dd117192abfa3ebadad54f5d968f9cb40a17f
SHA256b8ffb4e6dc082c8bf20298e5d6c6642270a6b67c91780f373cf0f0e83d01e8bd
SHA512fbab113fc5d77643af87af832750881a646744b35e82f7d2a3525c94b92fd510a008a9fa39b2d2eef183959ce3ea80e1edd325e83b5b9d38ada599fde3189e4c
-
Filesize
269KB
MD5af7ce801c8471c5cd19b366333c153c4
SHA14267749d020a362edbd25434ad65f98b073581f1
SHA256cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e
SHA51288655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c
-
Filesize
91KB
MD5396573acf88c363e3406677f3353d886
SHA195d078a2ff0eb1a884b932e08805cf178796b19b
SHA256e269f87987fb85313f0d1b276656020470b04e5e545784f5b3e03f9ca611b482
SHA512a5a0c72287044ebeba9ec45f46716592b945479a219b71a78e070f842a6d1c9c0c79d253946bf793b19b9dbbc2b05459ff7fdb0efaadc474c0b5190d828cc6b6
-
Filesize
169KB
MD54e96799dae53f059efc83a26d1a3e0f1
SHA1d4ce1ea0710338d4113e4079882d5995f2e1d23b
SHA2560b705033c702abe5165a1017ea922465bb4600c34708bd3275d13c766669cf7c
SHA512ad6328bd01d90cc8075467cc6b59808c39b59e99d61eeaa66039f4e614fba4b6b720f8ac2ca6e17ff05aa33ed3230ff73180340edfdd8221de699fe0fbefee81