d350237255f893af5d97ecdfc19a4f6871e5648c1c81e3ca0fe460a9aa61d3da

Resubmissions

08/07/2024, 19:52

240708-ylvblawclj 7

08/07/2024, 19:44

240708-yf3e1swajl 7

08/07/2024, 19:38

240708-ycgddavgmn 7

Analysis

max time kernel
1561s
max time network
1567s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

vcredist2015_2017_2019_2022_x64.exe
Size

24.1MB
MD5

cdce5d5ee259d8071fa82f522c5c7d6e
SHA1

d4f9181e70e3f1aa6c8edffcc15b3c3d4babe36b
SHA256

ce6593a1520591e7dea2b93fd03116e3fc3b3821a0525322b0a430faa6b3c0b4
SHA512

8f86693bf9fb4ee0ba021b826663028158d580a0424417a30d8f95ef8853fcd224b5a213beba5d99b48be0607a0a6870158bf1899fe1445da9ca19a208608527
SSDEEP

393216:JBCFpXQn0ZIoLTNOqMJgrBrIIvsHCwmMziQUv4qXvscamEZF/N4fsdx/78YHVkEv:JWpXDWoLTNOqMJcdyDz81Xv//MYkl

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2168	vcredist2015_2017_2019_2022_x64.exe

Loads dropped DLL 2 IoCs

pid	Process
2324	vcredist2015_2017_2019_2022_x64.exe
2168	vcredist2015_2017_2019_2022_x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2168	2324	vcredist2015_2017_2019_2022_x64.exe	31
PID 2324 wrote to memory of 2168	2324	vcredist2015_2017_2019_2022_x64.exe	31
PID 2324 wrote to memory of 2168	2324	vcredist2015_2017_2019_2022_x64.exe	31
PID 2324 wrote to memory of 2168	2324	vcredist2015_2017_2019_2022_x64.exe	31
PID 2324 wrote to memory of 2168	2324	vcredist2015_2017_2019_2022_x64.exe	31
PID 2324 wrote to memory of 2168	2324	vcredist2015_2017_2019_2022_x64.exe	31
PID 2324 wrote to memory of 2168	2324	vcredist2015_2017_2019_2022_x64.exe	31

C:\Users\Admin\AppData\Local\Temp\vcredist2015_2017_2019_2022_x64.exe
"C:\Users\Admin\AppData\Local\Temp\vcredist2015_2017_2019_2022_x64.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\Temp\{982B4706-A4BF-4992-BE7E-86FE7CDA666E}\.cr\vcredist2015_2017_2019_2022_x64.exe
  "C:\Windows\Temp\{982B4706-A4BF-4992-BE7E-86FE7CDA666E}\.cr\vcredist2015_2017_2019_2022_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vcredist2015_2017_2019_2022_x64.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\{52B8DF5C-0270-4F9A-9438-CCAD48578E0E}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
\Windows\Temp\{52B8DF5C-0270-4F9A-9438-CCAD48578E0E}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
\Windows\Temp\{982B4706-A4BF-4992-BE7E-86FE7CDA666E}\.cr\vcredist2015_2017_2019_2022_x64.exe

Filesize
635KB

MD5
d940ea062ed6e99f6d873c2f5f09d1c9

SHA1
6abec3341d3bca045542c7b812947b55ddaf6b64

SHA256
a0fce2b6c865ae4f00145c9b366c39484daf3160b526c77005e59f6f65adb202

SHA512
e4069e41311e8bd4599de0a1bdf0ee0b76316359a0c83ac663c23da8833e5dc0effa260fe8d0e47f4befa94c87fc7bf93bce2b79792abe8befc59acf5401cfe1

Download Submit