90e021b34e295ae9488b18ff093a9b7ef86560758702b90cf293ee03b5b23d46

Analysis

max time kernel
93s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2024 17:49

Target

American Medical Encyclopedia v1.0/MedEncyclopedia.exe
Size

8.4MB
MD5

22feba5399e1be994295a62504503dc0
SHA1

7c968dbfe9a8d1f2ea8c9f19d3358baf7cb62658
SHA256

16e838c8887216fd8bd202959309efc17947dffa10303ae63d0230ea97aec10e
SHA512

383fa30754c8e2dfd5ed359828341368386f73b0b90de67d6f8c0407e87516661b0cc67f872e7a22ccc73fc4a313d1fae12bf3b75556320f4382d9961ed94d55
SSDEEP

196608:XJKWISulOHC61mpjXqX1Ss+cHUfIiYbuSuzcsCyxdAkYzF+PjjzQw:XJKHSulOHCzLts+UU9YbuFc0xdByFg

Score

7^/10

discovery

Loads dropped DLL 1 IoCs

Processes:

MedEncyclopedia.exe

pid process

4724 MedEncyclopedia.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
4724	MedEncyclopedia.exe

Drops file in Program Files directory 10 IoCs

Processes:

MedEncyclopedia.exe

description	ioc	process
File created	C:\Program Files (x86)\MedEncyclopedia\med.cab	MedEncyclopedia.exe
File created	C:\Program Files (x86)\MedEncyclopedia\uninstall.exe	MedEncyclopedia.exe
File created	C:\Program Files (x86)\MedEncyclopedia\Licence.txt	MedEncyclopedia.exe
File opened for modification	C:\Program Files (x86)\MedEncyclopedia\Licence.txt	MedEncyclopedia.exe
File opened for modification	C:\Program Files (x86)\MedEncyclopedia\MedEncyclopedia.exe	MedEncyclopedia.exe
File created	C:\Program Files (x86)\MedEncyclopedia\MedEncyclopedia.exe	MedEncyclopedia.exe
File opened for modification	C:\Program Files (x86)\MedEncyclopedia\uninstall.exe	MedEncyclopedia.exe
File opened for modification	C:\Program Files (x86)\MedEncyclopedia\uninstall.ini	MedEncyclopedia.exe
File created	C:\Program Files (x86)\MedEncyclopedia\_ci_gentee_	MedEncyclopedia.exe
File opened for modification	C:\Program Files (x86)\MedEncyclopedia\med.cab	MedEncyclopedia.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

MedEncyclopedia.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings MedEncyclopedia.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings	MedEncyclopedia.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4904

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Program Files (x86)\MedEncyclopedia\MedEncyclopedia.exe

Filesize
1.1MB

MD5
511a8db7dad70c373838c3796cbfbcb6

SHA1
2d02d5d926753dd28ad31055ab0ce849f7453bf3

SHA256
cfee228a64fbfd84c399bc004f019192f20c9a1ecd60e8f27199722dd082c854

SHA512
3f4aa9492d614ecefb58dc61437de40df052f495bf795ad41c780038ee29c1e8dc08b9842dee7e545c438f9666b5d309b24c3a7942782fdfb017d046e3deff1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\LICENCE.TXT

Filesize
4KB

MD5
a14a3b654001132bfa685f9c9c51751e

SHA1
47d3e34ca873a378517ff1df2cf90ebe590e18cd

SHA256
b56c3fed787c3f1e63c6c8e125b1de42c87b8108c3e3acc3b764b7863148a470

SHA512
44fab2f9425e17d4b8f186ab158aa060ceae4446a37f637cbbcdd622a9726bed8b0d2e66cea39c7217d19f14242903b9b7f63a2a96382311e504f2a195b021fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\ginstall.dll

Filesize
58KB

MD5
2644550081e333aef9862ffab50c15c8

SHA1
36e744490dd310c9b6ca4b4648f3f635d27fd50e

SHA256
cdd6f588ff45946aff6849914ff1a5626c9e1cfbfa7ec6e4709f55d5faca25c0

SHA512
bb7e75070770387fdec81dc27b7635c7ae07bd2a6de54fcf15f81a8a98af5c39c074af8fa3b0727cc4a1c362146e0ad9a6196ba04c924a9cb9e9f27614ab3b73

Download Submit