90e021b34e295ae9488b18ff093a9b7ef86560758702b90cf293ee03b5b23d46

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-04-2024 17:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

American Medical Encyclopedia v1.0/MedEncyclopedia.exe
Size

8.4MB
MD5

22feba5399e1be994295a62504503dc0
SHA1

7c968dbfe9a8d1f2ea8c9f19d3358baf7cb62658
SHA256

16e838c8887216fd8bd202959309efc17947dffa10303ae63d0230ea97aec10e
SHA512

383fa30754c8e2dfd5ed359828341368386f73b0b90de67d6f8c0407e87516661b0cc67f872e7a22ccc73fc4a313d1fae12bf3b75556320f4382d9961ed94d55
SSDEEP

196608:XJKWISulOHC61mpjXqX1Ss+cHUfIiYbuSuzcsCyxdAkYzF+PjjzQw:XJKHSulOHCzLts+UU9YbuFc0xdByFg

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 4 IoCs

Processes:

MedEncyclopedia.exe

pid process

1912 MedEncyclopedia.exe
1912 MedEncyclopedia.exe
1912 MedEncyclopedia.exe
1912 MedEncyclopedia.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1912	MedEncyclopedia.exe
1912	MedEncyclopedia.exe
1912	MedEncyclopedia.exe
1912	MedEncyclopedia.exe

Drops file in Program Files directory 10 IoCs

Processes:

MedEncyclopedia.exe

description	ioc	process
File created	C:\Program Files (x86)\MedEncyclopedia\_ci_gentee_	MedEncyclopedia.exe
File created	C:\Program Files (x86)\MedEncyclopedia\Licence.txt	MedEncyclopedia.exe
File opened for modification	C:\Program Files (x86)\MedEncyclopedia\uninstall.ini	MedEncyclopedia.exe
File opened for modification	C:\Program Files (x86)\MedEncyclopedia\MedEncyclopedia.exe	MedEncyclopedia.exe
File created	C:\Program Files (x86)\MedEncyclopedia\MedEncyclopedia.exe	MedEncyclopedia.exe
File opened for modification	C:\Program Files (x86)\MedEncyclopedia\med.cab	MedEncyclopedia.exe
File created	C:\Program Files (x86)\MedEncyclopedia\med.cab	MedEncyclopedia.exe
File opened for modification	C:\Program Files (x86)\MedEncyclopedia\uninstall.exe	MedEncyclopedia.exe
File created	C:\Program Files (x86)\MedEncyclopedia\uninstall.exe	MedEncyclopedia.exe
File opened for modification	C:\Program Files (x86)\MedEncyclopedia\Licence.txt	MedEncyclopedia.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\American Medical Encyclopedia v1.0\MedEncyclopedia.exe
"C:\Users\Admin\AppData\Local\Temp\American Medical Encyclopedia v1.0\MedEncyclopedia.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\LICENCE.TXT

Filesize
4KB

MD5
a14a3b654001132bfa685f9c9c51751e

SHA1
47d3e34ca873a378517ff1df2cf90ebe590e18cd

SHA256
b56c3fed787c3f1e63c6c8e125b1de42c87b8108c3e3acc3b764b7863148a470

SHA512
44fab2f9425e17d4b8f186ab158aa060ceae4446a37f637cbbcdd622a9726bed8b0d2e66cea39c7217d19f14242903b9b7f63a2a96382311e504f2a195b021fd

Download Submit
\Program Files (x86)\MedEncyclopedia\MedEncyclopedia.exe

Filesize
1.1MB

MD5
511a8db7dad70c373838c3796cbfbcb6

SHA1
2d02d5d926753dd28ad31055ab0ce849f7453bf3

SHA256
cfee228a64fbfd84c399bc004f019192f20c9a1ecd60e8f27199722dd082c854

SHA512
3f4aa9492d614ecefb58dc61437de40df052f495bf795ad41c780038ee29c1e8dc08b9842dee7e545c438f9666b5d309b24c3a7942782fdfb017d046e3deff1e

Download Submit
\Program Files (x86)\MedEncyclopedia\uninstall.exe

Filesize
20KB

MD5
8fde804d40de5e735c717470a494ec9a

SHA1
735046d85f4f11db7273528819df42bd65c8bef4

SHA256
bf04c2b6880cba5487ae073660e3509a2ed530df2fd6a2b2bc7c7cb28f08ebd0

SHA512
2ab3e6b3b4dee8d6191624e143d1360b27a78c821b054900ae34ff58bf87975c2dcbf9cc1ab426575fa6fac093d9f69fdc26bc9d64869f5df39ddc64a97fd668

Download Submit
\Users\Admin\AppData\Local\Temp\ginstall.dll

Filesize
58KB

MD5
2644550081e333aef9862ffab50c15c8

SHA1
36e744490dd310c9b6ca4b4648f3f635d27fd50e

SHA256
cdd6f588ff45946aff6849914ff1a5626c9e1cfbfa7ec6e4709f55d5faca25c0

SHA512
bb7e75070770387fdec81dc27b7635c7ae07bd2a6de54fcf15f81a8a98af5c39c074af8fa3b0727cc4a1c362146e0ad9a6196ba04c924a9cb9e9f27614ab3b73

Download Submit