Analysis
-
max time kernel
61s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
25-07-2022 00:48
Static task
static1
Behavioral task
behavioral1
Sample
571332066aeb6f8483c731ce759352617a7a04babfe6528f5aabc43af60779d6.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
571332066aeb6f8483c731ce759352617a7a04babfe6528f5aabc43af60779d6.exe
Resource
win10v2004-20220721-en
General
-
Target
571332066aeb6f8483c731ce759352617a7a04babfe6528f5aabc43af60779d6.exe
-
Size
255KB
-
MD5
119cee7db4088573b7de087a262c94c5
-
SHA1
d5ac69221304c9b99042a6b064a8c05ca36b22e6
-
SHA256
571332066aeb6f8483c731ce759352617a7a04babfe6528f5aabc43af60779d6
-
SHA512
494653c265f7b4569982ac265e503e009ae9d1388a48de03ac3e63820a2545210644ba1fa916fc3bc97493636c8f62191ef71d38ce7430cd79780baa66488ff3
Malware Config
Signatures
-
suricata: ET MALWARE ETag HTTP Header Observed at JPCERT Sinkhole
suricata: ET MALWARE ETag HTTP Header Observed at JPCERT Sinkhole
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
571332066aeb6f8483c731ce759352617a7a04babfe6528f5aabc43af60779d6.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum 571332066aeb6f8483c731ce759352617a7a04babfe6528f5aabc43af60779d6.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum 571332066aeb6f8483c731ce759352617a7a04babfe6528f5aabc43af60779d6.exe -
Drops file in Windows directory 1 IoCs
Processes:
571332066aeb6f8483c731ce759352617a7a04babfe6528f5aabc43af60779d6.exedescription ioc process File created C:\Windows\Tasks\SmartHues.job 571332066aeb6f8483c731ce759352617a7a04babfe6528f5aabc43af60779d6.exe