Analysis

  • max time kernel
    92s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-04-2024 10:38

General

  • Target

    vcredist2015_2017_2019_2022_x86.exe

  • Size

    13.2MB

  • MD5

    ae427c1329c3b211a6d09f8d9506eb74

  • SHA1

    c9b5b7969e499a4fd9e580ef4187322778e1936a

  • SHA256

    5365a927487945ecb040e143ea770adbb296074ece4021b1d14213bde538c490

  • SHA512

    ec70786704ead0494fab8f7a9f46554feaca45c79b831c5963ecc20243fa0f31053b6e0ceb450f86c16e67e739c4be53ad202c2397c8541365b7252904169b41

  • SSDEEP

    393216:yvRtlptVYmfr7yBG/41w0vJROFTfCTKw27:y1pttD7yBG/OTvJRGCN27

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\vcredist2015_2017_2019_2022_x86.exe
    "C:\Users\Admin\AppData\Local\Temp\vcredist2015_2017_2019_2022_x86.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2116
    • C:\Windows\Temp\{917DD45C-5930-41A3-B49E-744BB80929AA}\.cr\vcredist2015_2017_2019_2022_x86.exe
      "C:\Windows\Temp\{917DD45C-5930-41A3-B49E-744BB80929AA}\.cr\vcredist2015_2017_2019_2022_x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vcredist2015_2017_2019_2022_x86.exe" -burn.filehandle.attached=648 -burn.filehandle.self=536
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3872

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Temp\{663C6A74-896F-4BC7-BAFD-84EB53BA74B3}\.ba\logo.png

    Filesize

    1KB

    MD5

    d6bd210f227442b3362493d046cea233

    SHA1

    ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

    SHA256

    335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

    SHA512

    464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

  • C:\Windows\Temp\{663C6A74-896F-4BC7-BAFD-84EB53BA74B3}\.ba\wixstdba.dll

    Filesize

    191KB

    MD5

    eab9caf4277829abdf6223ec1efa0edd

    SHA1

    74862ecf349a9bedd32699f2a7a4e00b4727543d

    SHA256

    a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

    SHA512

    45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

  • C:\Windows\Temp\{917DD45C-5930-41A3-B49E-744BB80929AA}\.cr\vcredist2015_2017_2019_2022_x86.exe

    Filesize

    634KB

    MD5

    415e8d504ea08ee2d8515fe87b820910

    SHA1

    e90f591c730bd39b8343ca3689b2c0ee85aaea5f

    SHA256

    e0e642106c94fd585782b75d1f942872d2bf99d870bed4216e5001e4ba3374c0

    SHA512

    e51f185c0e9d3eb4950a4c615285c6610a4977a696ed9f3297a551835097b2122566122231437002c82e2c5cf72a7a8f67362bff16b24c0abe05fe35dddbf6a1