200e0142448c4bccb6e6c24d2563a4922843bf977fcee5fdc4f41ddfdfe3af65

Analysis

max time kernel
130s
max time network
126s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65b67ab3bc4ea243830a9a832b780397.exe
Size

327KB
MD5

65b67ab3bc4ea243830a9a832b780397
SHA1

00a7eb407ff8417fa4fe84dbc57c498b968ea334
SHA256

200e0142448c4bccb6e6c24d2563a4922843bf977fcee5fdc4f41ddfdfe3af65
SHA512

5ab76bc79993ffd1c825b4d074220998a891281d8b7c3a9367d97f8585365b74c12710face81fd2a3431a25f6d3af36b52cab67df7635d33763f2e61ea4637ce
SSDEEP

6144:Jr469uEo2S1YnQmCX492DkwNP3qpYFGgjwuBGVdLAt4ZHd2i3gjd+ZD/6FI:Jr4iu6/eIo4Rsw33AtsmQ9

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2936	65b67ab3bc4ea243830a9a832b780397.exe
2936	65b67ab3bc4ea243830a9a832b780397.exe
2936	65b67ab3bc4ea243830a9a832b780397.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	65b67ab3bc4ea243830a9a832b780397.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	65b67ab3bc4ea243830a9a832b780397.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2936	65b67ab3bc4ea243830a9a832b780397.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2936	65b67ab3bc4ea243830a9a832b780397.exe

C:\Users\Admin\AppData\Local\Temp\65b67ab3bc4ea243830a9a832b780397.exe
"C:\Users\Admin\AppData\Local\Temp\65b67ab3bc4ea243830a9a832b780397.exe"
1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Tsu54DBF04E.dll

Filesize
98KB

MD5
f91b40cef6d64c9822cb11f26a6387a0

SHA1
a72d38990d2f0ee36514fa3d826b376128d55d18

SHA256
4205eb438ae3dda7823e29e8a10b8de09d3d3392bddc384c76d27f200ddf01db

SHA512
d3a2858d976f650f5733a03919be2f9d8f6c34a2f40ad60bd11abd619d2df1597433a30e0399efd47b15491351dd7205facf2aadcf865a37e5ccb8f20a79d589

Download Submit