ffb7484dbd43f1a8de746604b64da32f8f408b8c76429cb8d36c0fe6c31d6438

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
18-02-2024 02:05

Target

dependencies/vcredist2015_2017_2019_2022_x64.exe
Size

24.2MB
MD5

101b0b9f74cdc6cdbd2570bfe92e302c
SHA1

2e6bae42c2842b4f558bd68099479b929bb7d910
SHA256

4dfe83c91124cd542f4222fe2c396cabeac617bb6f59bdcbdf89fd6f0df0a32f
SHA512

ccf4fd7da2c3440f1bc7fcac67c8a12599eab8d5c015affdc2e439fa30f5c7868ef5f52ede058361faae37ccc4af2c17c0adf30b8e1f852bb7106d0ec7162506
SSDEEP

786432:urp+Ty2SfUfnbu+zMFy/7zYgWXRLTArzttOaaFC:Sp+Ty2SfWnPzMFO7zYgWBLbFC

Score

7^/10

discovery

Executes dropped EXE 1 IoCs

Processes:

vcredist2015_2017_2019_2022_x64.exe

pid process

804 vcredist2015_2017_2019_2022_x64.exe
Loads dropped DLL 2 IoCs

Processes:

vcredist2015_2017_2019_2022_x64.exevcredist2015_2017_2019_2022_x64.exe

pid process

2264 vcredist2015_2017_2019_2022_x64.exe
804 vcredist2015_2017_2019_2022_x64.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
804	vcredist2015_2017_2019_2022_x64.exe

pid	process
2264	vcredist2015_2017_2019_2022_x64.exe
804	vcredist2015_2017_2019_2022_x64.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

vcredist2015_2017_2019_2022_x64.exe

description	pid	process	target process
PID 2264 wrote to memory of 804	2264	vcredist2015_2017_2019_2022_x64.exe	vcredist2015_2017_2019_2022_x64.exe
PID 2264 wrote to memory of 804	2264	vcredist2015_2017_2019_2022_x64.exe	vcredist2015_2017_2019_2022_x64.exe
PID 2264 wrote to memory of 804	2264	vcredist2015_2017_2019_2022_x64.exe	vcredist2015_2017_2019_2022_x64.exe
PID 2264 wrote to memory of 804	2264	vcredist2015_2017_2019_2022_x64.exe	vcredist2015_2017_2019_2022_x64.exe
PID 2264 wrote to memory of 804	2264	vcredist2015_2017_2019_2022_x64.exe	vcredist2015_2017_2019_2022_x64.exe
PID 2264 wrote to memory of 804	2264	vcredist2015_2017_2019_2022_x64.exe	vcredist2015_2017_2019_2022_x64.exe
PID 2264 wrote to memory of 804	2264	vcredist2015_2017_2019_2022_x64.exe	vcredist2015_2017_2019_2022_x64.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Windows\Temp\{32135EFE-C923-4859-A47B-1B87BF849BC8}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
\Windows\Temp\{32135EFE-C923-4859-A47B-1B87BF849BC8}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
\Windows\Temp\{F6DEC945-75A8-4BA6-A8FD-43246BE44B7A}\.cr\vcredist2015_2017_2019_2022_x64.exe

Filesize
635KB

MD5
53e9222bc438cbd8b7320f800bef2e78

SHA1
c4f295d8855b4b16c7450a4a9150eb95046f6390

SHA256
0e49026767420229afd23b1352cf9f97f24e0768c3d527000d449ffdb4ca6888

SHA512
7533f9791e1807072a4dbb6ca03c696b12dfa5337678fab53aceea0e4b7e5ffefb90c9b450ac80878e1e9a4bce549f619da4cd2d06eb2554c9add5b4ec838b4a

Download Submit