127807aa139ff827e661c3da6933da89183199a1c4b3dfb1c80dcd22a6f46e3a

Analysis

max time kernel
6s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 13:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

19a1f7d09b704918fcee4f53374ccd0b.exe
Size

304KB
MD5

19a1f7d09b704918fcee4f53374ccd0b
SHA1

92f58283e12c49141cebfd1fbdac656b2de14fea
SHA256

127807aa139ff827e661c3da6933da89183199a1c4b3dfb1c80dcd22a6f46e3a
SHA512

cc2d8d452613cc8f6b96907b3758f3d04983bd00c73c49272fd099861edd16a1615a39ec0009fb36c918757de526117dae52dc815e39e52cdadfce2490b5e58a
SSDEEP

6144:lrkW9uEo2S1YnQmCX492DkwNP3qpYF4AqqWb+qR9h+uqkNfoM6YV5TmNa1a3SyPz:lrkuu6/eIo4tQW62T+uTwM6YVxm24z

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1256	19a1f7d09b704918fcee4f53374ccd0b.exe
1256	19a1f7d09b704918fcee4f53374ccd0b.exe
1256	19a1f7d09b704918fcee4f53374ccd0b.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	19a1f7d09b704918fcee4f53374ccd0b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	19a1f7d09b704918fcee4f53374ccd0b.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1256	19a1f7d09b704918fcee4f53374ccd0b.exe

C:\Users\Admin\AppData\Local\Temp\19a1f7d09b704918fcee4f53374ccd0b.exe
"C:\Users\Admin\AppData\Local\Temp\19a1f7d09b704918fcee4f53374ccd0b.exe"
1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:1256
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tin13B9.bat"
  2⤵
  PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Tsu4C0C3C16.dll

Filesize
92KB

MD5
1f905acec7b77e7b5a1c6c85c397acfc

SHA1
22331834ed8b991c4db0695f9c677316b0b7c592

SHA256
bb6cb380d01828b1f53b98f8dada1e9b879cf1b959145f3071ed5bf4016307be

SHA512
c8d925b0d8636ae9434f0c1c6bed739a2c3e7108642e9e32e5aac28a383cab9a2aa63773eea20e1cd0504a75bb2c0fbb7923cacb2ab1d0450e307e5e4cf507d4

Download Submit