3dec0ff4f9e0ac0906b749ef56da406ff617aa55d7c5d5f1b3a2adf13b6c6602 | Triage

Analysis

max time kernel
143s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
01-07-2022 14:00

Sharing

Report Analysis Logs

General

Target

8784986-9541-0131-Nr.exe
Size

639KB
MD5

7a39b812619d1283ec69bddaa75fb124
SHA1

a209289eeabff14dc4c43ff6bf8b746dd509290b
SHA256

35d376b1424c130ed3c5cd2f15a882fb8f7c37fed1e9ffd030493606ea52dc28
SHA512

a2783b73e01c7ca39a51fc45d5e3c6d35367409d02fab8350f56f7f0d39cd8ae77b8dbe0b5f03446a1d8b2512493eb81d3bc708d5235271829fa20d3d834c114

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

8784986-9541-0131-Nr.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 8784986-9541-0131-Nr.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

8784986-9541-0131-Nr.exe

pid process

4276 8784986-9541-0131-Nr.exe
4276 8784986-9541-0131-Nr.exe

C:\Users\Admin\AppData\Local\Temp\8784986-9541-0131-Nr.exe
"C:\Users\Admin\AppData\Local\Temp\8784986-9541-0131-Nr.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4276-130-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4276-131-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download