392303316f0055c7c0c848ecf2feefa5d9476cdab9816fd42dcd621dfff2d2c0

Analysis

max time kernel
146s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 15:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HA_RegCleanerPro301_WGL.exe
Size

2.1MB
MD5

0dfb5a108d49973ff9beb3cc7da04446
SHA1

a60122d5879c821980187c7eebf4dc300e542eed
SHA256

853f61351b2adf3e545d79705d7e7c0760252022ef2a3ee9eef96d7e51f24cae
SHA512

8fc9b8de198a89ca1c3be2b1678850ecabbaee043fb827426b5c6b09dc841fcbf9972f2386802d48e5506d00e28e18cfa66889c9c011f1f0e3a4a2a0c55e1417
SSDEEP

49152:B6dBjNt8DRnftfkdB4tjI6y1dbJSdH4cI9sj+jTnZd:kdtNt8dft8B4y1mYcpjETZd

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2192	is-4GKRM.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2192	1972	HA_RegCleanerPro301_WGL.exe	91
PID 1972 wrote to memory of 2192	1972	HA_RegCleanerPro301_WGL.exe	91
PID 1972 wrote to memory of 2192	1972	HA_RegCleanerPro301_WGL.exe	91

C:\Users\Admin\AppData\Local\Temp\HA_RegCleanerPro301_WGL.exe
"C:\Users\Admin\AppData\Local\Temp\HA_RegCleanerPro301_WGL.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Users\Admin\AppData\Local\Temp\is-D5AT0.tmp\is-4GKRM.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-D5AT0.tmp\is-4GKRM.tmp" /SL4 $100028 "C:\Users\Admin\AppData\Local\Temp\HA_RegCleanerPro301_WGL.exe" 1909570 72704
  2⤵
  - Executes dropped EXE
  PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-D5AT0.tmp\is-4GKRM.tmp

Filesize
656KB

MD5
69c66d1add37a646768cebcc958596c2

SHA1
c2018243dfe654bc70b9eefd9069b91be914406b

SHA256
4924545a8983a732951cc5c99a6b0365e5d98ad5f655e9abb3770031a8b3af6f

SHA512
ab59bcf5b9d1ebfedb5e4e90bf37164d7273329ce198acce5f0f2d1b5f03c7c5f244842a4fa281974aeaa90e7c3462ac1a6a864b6d5b2f2af033858c3b4ecc25

Download Submit
memory/1972-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1972-2-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1972-12-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2192-9-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/2192-13-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/2192-16-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download