fdd2551696ea2f0d3ee85b0087e43056cc976055be13977c9ece574a11704cfe

Analysis

max time kernel
83s
max time network
99s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
08-06-2024 17:19

Target

install_all/dotnet-sdk-6.0.422-win-x64.exe
Size

192.1MB
MD5

bdb1f0bc231a5db9313d31d55076a77d
SHA1

97ff04aa38fc5726aa53ec611724b1725e9e37c0
SHA256

898ec516835af06e04b6652ab1e8d1337bb1e560a16484baa6b5441e64b778a1
SHA512

9ef9f83eaff52145d91d48b4326bfd7926eb20b25e069461ff4f132fbe5d534e7271c719a848b5766635cdc31d0f67a4820d60438e9db5f384d1ca82a627f315
SSDEEP

3145728:H5QtBju8PhY6aFizFjsHnrxIB53tm1ozlCi6OSMW9SwArZXUYcnxe02DIU:K7n1aAjsHraBFtsogtFRSBXlDx

Score

4^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Executes dropped EXE 1 IoCs

Processes:

dotnet-sdk-6.0.422-win-x64.exe

pid process

1708 dotnet-sdk-6.0.422-win-x64.exe
Loads dropped DLL 1 IoCs

Processes:

dotnet-sdk-6.0.422-win-x64.exe

pid process

1708 dotnet-sdk-6.0.422-win-x64.exe

pid	process
1708	dotnet-sdk-6.0.422-win-x64.exe

pid	process
1708	dotnet-sdk-6.0.422-win-x64.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

dotnet-sdk-6.0.422-win-x64.exe

description	pid	process	target process
PID 3128 wrote to memory of 1708	3128	dotnet-sdk-6.0.422-win-x64.exe	dotnet-sdk-6.0.422-win-x64.exe
PID 3128 wrote to memory of 1708	3128	dotnet-sdk-6.0.422-win-x64.exe	dotnet-sdk-6.0.422-win-x64.exe
PID 3128 wrote to memory of 1708	3128	dotnet-sdk-6.0.422-win-x64.exe	dotnet-sdk-6.0.422-win-x64.exe

C:\Users\Admin\AppData\Local\Temp\install_all\dotnet-sdk-6.0.422-win-x64.exe
"C:\Users\Admin\AppData\Local\Temp\install_all\dotnet-sdk-6.0.422-win-x64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3128

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Windows\Temp\{3D096209-A663-4121-B6A7-C1C1E5AA1FEB}\.cr\dotnet-sdk-6.0.422-win-x64.exe

Filesize
610KB

MD5
a77f2155ca9230a300d75c35f73659f9

SHA1
67193e58e5e1cdfe43a2a0eebfa2c0eb917c352e

SHA256
47316c4be2f2064a7dd99a7874a71c9f944fa06038d5a9eab75171ba8fdc7381

SHA512
5e91d9dd52cad1676abe8b5a752a54d78f13903da55137106427f2516aa6c068475010e523efbca8e374024ae3769b0362adafe0313963903d2474d068b6b7ca

Download Submit
C:\Windows\Temp\{5EB94453-2C97-4272-8D18-3D250E5E88AD}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{5EB94453-2C97-4272-8D18-3D250E5E88AD}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit