576057e17c481c99d5a88236617a3fc0ec562015d5825f872d42381fd03a6953

Analysis

max time kernel
81s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
24-07-2022 23:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

576057e17c481c99d5a88236617a3fc0ec562015d5825f872d42381fd03a6953.exe
Size

309KB
MD5

7162b8f77b5ef72196a4b644a2f13913
SHA1

7ecf15d5f1a031ac46d4f3fefc23ab4a6e72ed36
SHA256

576057e17c481c99d5a88236617a3fc0ec562015d5825f872d42381fd03a6953
SHA512

fe57fd1cac36f1d6e13c0334bec6a778e73ae786e6f54dc3099b1e34a0fe00255f7d78c887ad8ee9af50b0ae4a715523f960dd64b116c2f5185ef8b9b4c762d4

Score

10^/10

suricata

Malware Config

Signatures

suricata: ET MALWARE ETag HTTP Header Observed at JPCERT Sinkhole
suricata: ET MALWARE ETag HTTP Header Observed at JPCERT Sinkhole
suricata

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

576057e17c481c99d5a88236617a3fc0ec562015d5825f872d42381fd03a6953.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	576057e17c481c99d5a88236617a3fc0ec562015d5825f872d42381fd03a6953.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	576057e17c481c99d5a88236617a3fc0ec562015d5825f872d42381fd03a6953.exe

Drops file in Windows directory 1 IoCs

Processes:

576057e17c481c99d5a88236617a3fc0ec562015d5825f872d42381fd03a6953.exe

description ioc process

File created C:\Windows\Tasks\Best DJPro.job 576057e17c481c99d5a88236617a3fc0ec562015d5825f872d42381fd03a6953.exe

description	ioc	process
File created	C:\Windows\Tasks\Best DJPro.job	576057e17c481c99d5a88236617a3fc0ec562015d5825f872d42381fd03a6953.exe

C:\Users\Admin\AppData\Local\Temp\576057e17c481c99d5a88236617a3fc0ec562015d5825f872d42381fd03a6953.exe
"C:\Users\Admin\AppData\Local\Temp\576057e17c481c99d5a88236617a3fc0ec562015d5825f872d42381fd03a6953.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:4180

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4180-130-0x00000000019F0000-0x0000000001A1F000-memory.dmp

Filesize
188KB

Download
memory/4180-134-0x0000000004D80000-0x0000000004DA7000-memory.dmp

Filesize
156KB

Download