6f785c3e70d6ff330e829d415da2005982778111775904444e83b2a33b089b9d

General

Target

7ec2e4b4e8d8c339525379ae2dd49f38.exe
Size

3.7MB
MD5

d8217ae9b608cbeb9c9da5eb977961a6
SHA1

167622f5c4cced3a6bd6e824331e97ffb10389a6
SHA256

6f785c3e70d6ff330e829d415da2005982778111775904444e83b2a33b089b9d
SHA512

53e4bb0dd9e470ba002d4f03250bbfdd0bfb6fc069b4c7b289a434772b1303831bab1d255770abf49fa9f4e69fb34043760b62f250474082ec94835050dbceb7

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

7ec2e4b4e8d8c339525379ae2dd49f38.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	7ec2e4b4e8d8c339525379ae2dd49f38.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\Count	7ec2e4b4e8d8c339525379ae2dd49f38.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	7ec2e4b4e8d8c339525379ae2dd49f38.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

7ec2e4b4e8d8c339525379ae2dd49f38.exe

description pid process target process

PID 3160 set thread context of 1544 3160 7ec2e4b4e8d8c339525379ae2dd49f38.exe 7ec2e4b4e8d8c339525379ae2dd49f38.exe

description	pid	process	target process
PID 3160 set thread context of 1544	3160	7ec2e4b4e8d8c339525379ae2dd49f38.exe	7ec2e4b4e8d8c339525379ae2dd49f38.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

7ec2e4b4e8d8c339525379ae2dd49f38.exe

pid	process
1544	7ec2e4b4e8d8c339525379ae2dd49f38.exe
1544	7ec2e4b4e8d8c339525379ae2dd49f38.exe
1544	7ec2e4b4e8d8c339525379ae2dd49f38.exe
1544	7ec2e4b4e8d8c339525379ae2dd49f38.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

7ec2e4b4e8d8c339525379ae2dd49f38.exe

pid	process
1544	7ec2e4b4e8d8c339525379ae2dd49f38.exe
1544	7ec2e4b4e8d8c339525379ae2dd49f38.exe
1544	7ec2e4b4e8d8c339525379ae2dd49f38.exe
1544	7ec2e4b4e8d8c339525379ae2dd49f38.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

7ec2e4b4e8d8c339525379ae2dd49f38.exe

C:\Users\Admin\AppData\Local\Temp\7ec2e4b4e8d8c339525379ae2dd49f38.exe
"C:\Users\Admin\AppData\Local\Temp\7ec2e4b4e8d8c339525379ae2dd49f38.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3160

C:\Users\Admin\AppData\Local\Temp\7ec2e4b4e8d8c339525379ae2dd49f38.exe
"C:\Users\Admin\AppData\Local\Temp\7ec2e4b4e8d8c339525379ae2dd49f38.exe"
2⤵
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1544

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1544-1-0x0000000000778001-mapping.dmp

Download
memory/1544-0-0x0000000000400000-0x00000000007AF000-memory.dmp

Filesize
3.7MB

Download
memory/1544-2-0x0000000000400000-0x00000000007AF000-memory.dmp

Filesize
3.7MB

Download
memory/1544-3-0x0000000006090000-0x0000000006091000-memory.dmp

Filesize
4KB

Download
memory/1544-4-0x0000000006090000-0x0000000006091000-memory.dmp

Filesize
4KB

Download
memory/1544-74-0x0000000006090000-0x0000000006091000-memory.dmp

Filesize
4KB

Download
memory/1544-75-0x0000000006090000-0x0000000006091000-memory.dmp

Filesize
4KB

Download

description	pid	process	target process
PID 3160 wrote to memory of 1544	3160	7ec2e4b4e8d8c339525379ae2dd49f38.exe	7ec2e4b4e8d8c339525379ae2dd49f38.exe
PID 3160 wrote to memory of 1544	3160	7ec2e4b4e8d8c339525379ae2dd49f38.exe	7ec2e4b4e8d8c339525379ae2dd49f38.exe
PID 3160 wrote to memory of 1544	3160	7ec2e4b4e8d8c339525379ae2dd49f38.exe	7ec2e4b4e8d8c339525379ae2dd49f38.exe
PID 3160 wrote to memory of 1544	3160	7ec2e4b4e8d8c339525379ae2dd49f38.exe	7ec2e4b4e8d8c339525379ae2dd49f38.exe
PID 3160 wrote to memory of 1544	3160	7ec2e4b4e8d8c339525379ae2dd49f38.exe	7ec2e4b4e8d8c339525379ae2dd49f38.exe
PID 3160 wrote to memory of 1544	3160	7ec2e4b4e8d8c339525379ae2dd49f38.exe	7ec2e4b4e8d8c339525379ae2dd49f38.exe
PID 3160 wrote to memory of 1544	3160	7ec2e4b4e8d8c339525379ae2dd49f38.exe	7ec2e4b4e8d8c339525379ae2dd49f38.exe
PID 3160 wrote to memory of 1544	3160	7ec2e4b4e8d8c339525379ae2dd49f38.exe	7ec2e4b4e8d8c339525379ae2dd49f38.exe
PID 3160 wrote to memory of 1544	3160	7ec2e4b4e8d8c339525379ae2dd49f38.exe	7ec2e4b4e8d8c339525379ae2dd49f38.exe
PID 3160 wrote to memory of 1544	3160	7ec2e4b4e8d8c339525379ae2dd49f38.exe	7ec2e4b4e8d8c339525379ae2dd49f38.exe
PID 3160 wrote to memory of 1544	3160	7ec2e4b4e8d8c339525379ae2dd49f38.exe	7ec2e4b4e8d8c339525379ae2dd49f38.exe
PID 3160 wrote to memory of 1544	3160	7ec2e4b4e8d8c339525379ae2dd49f38.exe	7ec2e4b4e8d8c339525379ae2dd49f38.exe
PID 3160 wrote to memory of 1544	3160	7ec2e4b4e8d8c339525379ae2dd49f38.exe	7ec2e4b4e8d8c339525379ae2dd49f38.exe
PID 3160 wrote to memory of 1544	3160	7ec2e4b4e8d8c339525379ae2dd49f38.exe	7ec2e4b4e8d8c339525379ae2dd49f38.exe
PID 3160 wrote to memory of 1544	3160	7ec2e4b4e8d8c339525379ae2dd49f38.exe	7ec2e4b4e8d8c339525379ae2dd49f38.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads