Analysis

  • max time kernel
    19s
  • max time network
    21s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241211-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    24-12-2024 09:37

General

  • Target

    ed7b96b21415dbada5c6efce55d0ee42ea2641aab139ed67718feb8ba48740d2.exe

  • Size

    14.0MB

  • MD5

    91fba794db9b4000b67f1f34d746f118

  • SHA1

    bc9f1819e94a33d8129df88dfccbb5d135382185

  • SHA256

    ed7b96b21415dbada5c6efce55d0ee42ea2641aab139ed67718feb8ba48740d2

  • SHA512

    5940f740ad28d5a16ecc91b13fba8d768dd4666413f7288a114f4f797c790e1900da693d84fa4ab14db169bf16168f4faf1edcd992be2ab6f1e07a6704dffd78

  • SSDEEP

    196608:fmRjUzJ/LflpQcIIS/Rj7BWl+aV8t8z72BxBwBgO46viGqANE6c9QvJM4IR92gTA:mG/rlptVYmfr7yBG/4dp6wf4IPAaGBDV

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed7b96b21415dbada5c6efce55d0ee42ea2641aab139ed67718feb8ba48740d2.exe
    "C:\Users\Admin\AppData\Local\Temp\ed7b96b21415dbada5c6efce55d0ee42ea2641aab139ed67718feb8ba48740d2.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1136
    • C:\Users\Admin\AppData\Local\Temp\VS2019ÔËÐпâ\VC_15-19redist.x86.exe
      C:\Users\Admin\AppData\Local\Temp\VS2019ÔËÐпâ\VC_15-19redist.x86.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3532
      • C:\Windows\Temp\{FF32DEF1-DBE1-4E8F-8476-3580000A2187}\.cr\VC_15-19redist.x86.exe
        "C:\Windows\Temp\{FF32DEF1-DBE1-4E8F-8476-3580000A2187}\.cr\VC_15-19redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\VS2019ÔËÐпâ\VC_15-19redist.x86.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4080
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations=is-enterprise-managed=no --field-trial-handle=1728,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:8
    1⤵
      PID:5028

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\VS2019ÔËÐпâ\VC_15-19redist.x86.exe

      Filesize

      13.7MB

      MD5

      ae847b3fbabee336879a72e53962c12c

      SHA1

      aa56b7fe64e957fba2a6bdc65abbaa47438ec620

      SHA256

      4a8157b2ff422c259ddaa2d0e568c0c0afab940e1f6e0e482ef83e90ddbad2d6

      SHA512

      740fe01920043559c85484624e58a9ad028fe960206ddc56d180ac579c83901e9237095eb085fba3ea1b66cd6bb85dd61d333d266662e643df07ee4a2cc19678

    • C:\Windows\Temp\{F3EA56EE-0725-44D7-BFBA-45D6D7701824}\.ba\logo.png

      Filesize

      1KB

      MD5

      d6bd210f227442b3362493d046cea233

      SHA1

      ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

      SHA256

      335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

      SHA512

      464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

    • C:\Windows\Temp\{F3EA56EE-0725-44D7-BFBA-45D6D7701824}\.ba\wixstdba.dll

      Filesize

      191KB

      MD5

      eab9caf4277829abdf6223ec1efa0edd

      SHA1

      74862ecf349a9bedd32699f2a7a4e00b4727543d

      SHA256

      a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

      SHA512

      45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

    • C:\Windows\Temp\{FF32DEF1-DBE1-4E8F-8476-3580000A2187}\.cr\VC_15-19redist.x86.exe

      Filesize

      639KB

      MD5

      49df4919d788ba775609707980c61698

      SHA1

      e59cd4518914b1b346b9772ff10dae25792592ec

      SHA256

      5a0d273208b6126d7f45451732e81bcc1b79c79466caa3ac65c9e00a9fff5930

      SHA512

      87c9f445df57b079ddd8128c77f6c783e3823df58611eb1aa9bd752ee6f3e17ee8b1494d26738e0735131ea8cdcbf42d80b7b7f49ef1362b720ac4bf2a944a7e