0b906d558787db76d4c71c703720f3212e38c28ce343e3c9cbb770cef197c8be

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 04:21

Target

97e296f77f96ea55d1e0f962f0fe980170a4e8d11464a7ca45b2976aa8ee16ee.exe
Size

27.0MB
MD5

db78eda8cb52e64d403890ad2201f007
SHA1

174c837386ce92144bb6c8d722e4809426b2519a
SHA256

97e296f77f96ea55d1e0f962f0fe980170a4e8d11464a7ca45b2976aa8ee16ee
SHA512

94691338ff0b788b16eed3eb2973b2534b5c7774ceba3aba11a2f73ee4d9e754c8039d47ed3b45ab55ea3e3a6f7138c5a70a40f516397167a97a36c2773c09ad
SSDEEP

786432:Ep3+DT+fEKOIYSwpcPa39JWJ2GsaZ/mCoq31/:l+MKrYSwqPa3HW7saZ/mPYJ

Score

4^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Executes dropped EXE 1 IoCs

Processes:

97e296f77f96ea55d1e0f962f0fe980170a4e8d11464a7ca45b2976aa8ee16ee.exe

pid process

2996 97e296f77f96ea55d1e0f962f0fe980170a4e8d11464a7ca45b2976aa8ee16ee.exe

pid	process
2996	97e296f77f96ea55d1e0f962f0fe980170a4e8d11464a7ca45b2976aa8ee16ee.exe

Loads dropped DLL 2 IoCs

Processes:

97e296f77f96ea55d1e0f962f0fe980170a4e8d11464a7ca45b2976aa8ee16ee.exe97e296f77f96ea55d1e0f962f0fe980170a4e8d11464a7ca45b2976aa8ee16ee.exe

pid	process
2932	97e296f77f96ea55d1e0f962f0fe980170a4e8d11464a7ca45b2976aa8ee16ee.exe
2996	97e296f77f96ea55d1e0f962f0fe980170a4e8d11464a7ca45b2976aa8ee16ee.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

97e296f77f96ea55d1e0f962f0fe980170a4e8d11464a7ca45b2976aa8ee16ee.exe

description	pid	process	target process
PID 2932 wrote to memory of 2996	2932	97e296f77f96ea55d1e0f962f0fe980170a4e8d11464a7ca45b2976aa8ee16ee.exe	97e296f77f96ea55d1e0f962f0fe980170a4e8d11464a7ca45b2976aa8ee16ee.exe
PID 2932 wrote to memory of 2996	2932	97e296f77f96ea55d1e0f962f0fe980170a4e8d11464a7ca45b2976aa8ee16ee.exe	97e296f77f96ea55d1e0f962f0fe980170a4e8d11464a7ca45b2976aa8ee16ee.exe
PID 2932 wrote to memory of 2996	2932	97e296f77f96ea55d1e0f962f0fe980170a4e8d11464a7ca45b2976aa8ee16ee.exe	97e296f77f96ea55d1e0f962f0fe980170a4e8d11464a7ca45b2976aa8ee16ee.exe
PID 2932 wrote to memory of 2996	2932	97e296f77f96ea55d1e0f962f0fe980170a4e8d11464a7ca45b2976aa8ee16ee.exe	97e296f77f96ea55d1e0f962f0fe980170a4e8d11464a7ca45b2976aa8ee16ee.exe
PID 2932 wrote to memory of 2996	2932	97e296f77f96ea55d1e0f962f0fe980170a4e8d11464a7ca45b2976aa8ee16ee.exe	97e296f77f96ea55d1e0f962f0fe980170a4e8d11464a7ca45b2976aa8ee16ee.exe
PID 2932 wrote to memory of 2996	2932	97e296f77f96ea55d1e0f962f0fe980170a4e8d11464a7ca45b2976aa8ee16ee.exe	97e296f77f96ea55d1e0f962f0fe980170a4e8d11464a7ca45b2976aa8ee16ee.exe
PID 2932 wrote to memory of 2996	2932	97e296f77f96ea55d1e0f962f0fe980170a4e8d11464a7ca45b2976aa8ee16ee.exe	97e296f77f96ea55d1e0f962f0fe980170a4e8d11464a7ca45b2976aa8ee16ee.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Windows\Temp\{2F5D0E32-74CF-48D8-B9F7-AC22FFBCECE8}\.ba\logo.png

Filesize
80KB

MD5
bc348d03ed3d614eeb776df9c17dd0c9

SHA1
0d0628742f480a07e08f251d7ffa6d2c671b6811

SHA256
bcc352480c5bb9be1021442b5f1c948a33504d75b9c76f899eb3244e0b40c786

SHA512
12b12b6ccece3de9e76562ca83e078cf502e0de34747abe84f70665bd2727f4cdd62d04a1811095440c5f52fcc2b4a07f3c45b2fd3bf7d1933b596a09b5cf311

Download Submit
\Windows\Temp\{2F5D0E32-74CF-48D8-B9F7-AC22FFBCECE8}\.ba\wixstdba.dll

Filesize
184KB

MD5
fe7e0bd53f52e6630473c31299a49fdd

SHA1
f706f45768bfb95f4c96dfa0be36df57aa863898

SHA256
2bea14d70943a42d344e09b7c9de5562fa7e109946e1c615dd584da30d06cc80

SHA512
feed48286b1e182996a3664f0facdf42aae3692d3d938ea004350c85764db7a0bea996dfddf7a77149c0d4b8b776fb544e8b1ce5e9944086a5b1ed6a8a239a3c

Download Submit
\Windows\Temp\{76FD82A7-C8CE-47E0-9774-32BD4C604DAD}\.cr\97e296f77f96ea55d1e0f962f0fe980170a4e8d11464a7ca45b2976aa8ee16ee.exe

Filesize
888KB

MD5
ddc2103d7db9f4b5ba331ed09293a336

SHA1
73bd031762f1168a4d7fed65bbc1663ca6cceb3c

SHA256
386a38dd828a617f60d11719ad5eaa3fa21a21b46f3871f5b4553e9f6e67aced

SHA512
2e77b5c6d7562bd23d1372903da819c5a905f791228dc89317159e9ed2c32e7dc40bb2067de6de3b43a887d3799b58fd44505d81fae3b6348e64bedeab2effb3

Download Submit