d99ac2a9df6c9e6d560270ca6561190cf4fd098096a5b61ac599d930811bd2c6

Analysis

max time kernel
60s
max time network
69s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 03:20

Target

resources/VC_redist.x64.exe
Size

24.0MB
MD5

291e0c486cbe22cb000c5e541c9e8317
SHA1

64e813bb9024a8e8d5aa64ee20e0d13de97ec7fd
SHA256

9b9dd72c27ab1db081de56bb7b73bee9a00f60d14ed8e6fde45dab3e619b5f04
SHA512

666da980e006648c8ea5eb09ed1d8bafb59bb8c8e798d18bd1c9b1f523237bb7c0d5937813a34ab37f6e0daefe8f2baf9373b73c0c9262fe3a1d88c0f4eae611
SSDEEP

786432:cRpXDWoLTNOqMh+953TE0r6UYNn0vk01cH:ApXDhLTNJMYfEq6UW0sTH

Score

7^/10

discovery

Executes dropped EXE 1 IoCs

Processes:

VC_redist.x64.exe

pid process

2136 VC_redist.x64.exe
Loads dropped DLL 1 IoCs

Processes:

VC_redist.x64.exe

pid process

2136 VC_redist.x64.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
2136	VC_redist.x64.exe

pid	process
2136	VC_redist.x64.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

VC_redist.x64.exe

description	pid	process	target process
PID 3320 wrote to memory of 2136	3320	VC_redist.x64.exe	VC_redist.x64.exe
PID 3320 wrote to memory of 2136	3320	VC_redist.x64.exe	VC_redist.x64.exe
PID 3320 wrote to memory of 2136	3320	VC_redist.x64.exe	VC_redist.x64.exe

C:\Users\Admin\AppData\Local\Temp\resources\VC_redist.x64.exe
"C:\Users\Admin\AppData\Local\Temp\resources\VC_redist.x64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Windows\Temp\{54E51010-F9E5-436F-B9F7-8DA4A7910E7F}\.cr\VC_redist.x64.exe
  "C:\Windows\Temp\{54E51010-F9E5-436F-B9F7-8DA4A7910E7F}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\resources\VC_redist.x64.exe" -burn.filehandle.attached=532 -burn.filehandle.self=540
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2136

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Windows\Temp\{54E51010-F9E5-436F-B9F7-8DA4A7910E7F}\.cr\VC_redist.x64.exe

Filesize
633KB

MD5
7f28c88875700454d8fb733341658edd

SHA1
434159872b168112b86e91cf84f4d9d545ab0410

SHA256
92d6a54089399fab9f00f25ccf568bdc2f4838aefbf37d51bc1ac94ed41508b9

SHA512
7b0d332ef78506e116ad620eb34424d7ca168822f768c30fe54a55168075e88d9fb40f1c4eb02498c3379843f50ac79bcc3d42a77b82d6157bfbd3fc4bd462fb

Download Submit
C:\Windows\Temp\{79D22823-AC2C-4917-A186-5C3D4A68CCC5}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{79D22823-AC2C-4917-A186-5C3D4A68CCC5}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit