622e3d046852caae4c28a71be174020dabbc6b21f2a1a320ac0c41c701a6a52c

Analysis

max time kernel
15s
max time network
18s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 21:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

windowsdesktop-runtime-8.0.7-win-x64.exe
Size

55.9MB
MD5

66284ac9aab49d957193e876398fa7ee
SHA1

13e289abd2284c0e88ce522651d73d64e502fc15
SHA256

622e3d046852caae4c28a71be174020dabbc6b21f2a1a320ac0c41c701a6a52c
SHA512

391ca05d7540c58f25047ae07b8c5656829f7fd32f6e88a4e34c5337525f574e5714657e1c4f4f4d48e006087f573f8c03f1fc8eab8c9b9dab4d5ca5c8ea1fd4
SSDEEP

1572864:8eiiqW3f72ws5HZXHI73A1lwEMDrJ9ium82:bXN3qws1ZYYbMJ9iu

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 1 IoCs

pid	Process
3004	windowsdesktop-runtime-8.0.7-win-x64.exe

Loads dropped DLL 2 IoCs

pid	Process
2776	windowsdesktop-runtime-8.0.7-win-x64.exe
3004	windowsdesktop-runtime-8.0.7-win-x64.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.7-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.7-win-x64.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 3004	2776	windowsdesktop-runtime-8.0.7-win-x64.exe	30
PID 2776 wrote to memory of 3004	2776	windowsdesktop-runtime-8.0.7-win-x64.exe	30
PID 2776 wrote to memory of 3004	2776	windowsdesktop-runtime-8.0.7-win-x64.exe	30
PID 2776 wrote to memory of 3004	2776	windowsdesktop-runtime-8.0.7-win-x64.exe	30
PID 2776 wrote to memory of 3004	2776	windowsdesktop-runtime-8.0.7-win-x64.exe	30
PID 2776 wrote to memory of 3004	2776	windowsdesktop-runtime-8.0.7-win-x64.exe	30
PID 2776 wrote to memory of 3004	2776	windowsdesktop-runtime-8.0.7-win-x64.exe	30

C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-8.0.7-win-x64.exe
"C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-8.0.7-win-x64.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\Temp\{36D81B6A-DC38-48E0-ACFB-23407C786BC4}\.cr\windowsdesktop-runtime-8.0.7-win-x64.exe
  "C:\Windows\Temp\{36D81B6A-DC38-48E0-ACFB-23407C786BC4}\.cr\windowsdesktop-runtime-8.0.7-win-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-8.0.7-win-x64.exe" -burn.filehandle.attached=288 -burn.filehandle.self=292
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\{AA7036E8-DEF7-4F36-8AF3-13D5A232B027}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
\Windows\Temp\{36D81B6A-DC38-48E0-ACFB-23407C786BC4}\.cr\windowsdesktop-runtime-8.0.7-win-x64.exe

Filesize
635KB

MD5
1021bcdda151fb3bad0513d8311dff8c

SHA1
fc93405fc3d52f48f13375e2aa637fdc64afd5c9

SHA256
ab0d30eeaad5eb3d1c697097e6099fe81cd303c5ba26d7d88168201163b1fff4

SHA512
d4500e7a7ecfac6aa0e944de3b197f7336db3327b012b5ed48ba1dd9f3f892e243da7a1785f60dd29895c0853d6313bbe9a6f131b95f91a75b9f92fcee01e361

Download Submit
\Windows\Temp\{AA7036E8-DEF7-4F36-8AF3-13D5A232B027}\.ba\wixstdba.dll

Filesize
215KB

MD5
f68f43f809840328f4e993a54b0d5e62

SHA1
01da48ce6c81df4835b4c2eca7e1d447be893d39

SHA256
e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e

SHA512
a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1

Download Submit