56620b7049d186c16d562f70c45c7ae1783c7c7a4d6c46a3914cf325dbdf9290

Analysis

max time kernel
73s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2022 03:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56620b7049d186c16d562f70c45c7ae1783c7c7a4d6c46a3914cf325dbdf9290.exe
Size

253KB
MD5

7343628e16648cd42d233a3e7dfeb3ba
SHA1

7d1d736525869403aae4e5c3cb4fadb03072ece6
SHA256

56620b7049d186c16d562f70c45c7ae1783c7c7a4d6c46a3914cf325dbdf9290
SHA512

3828fbc95887da964595bf5d4db6e47339e6e848440bdcd0405d9f38f3b1cadfaa577646658d7581250edb5f054cc379ab54990984d42a4ba147f14578f87a45

Score

10^/10

suricata

Malware Config

Signatures

suricata: ET MALWARE ETag HTTP Header Observed at JPCERT Sinkhole
suricata: ET MALWARE ETag HTTP Header Observed at JPCERT Sinkhole
suricata

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

56620b7049d186c16d562f70c45c7ae1783c7c7a4d6c46a3914cf325dbdf9290.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	56620b7049d186c16d562f70c45c7ae1783c7c7a4d6c46a3914cf325dbdf9290.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	56620b7049d186c16d562f70c45c7ae1783c7c7a4d6c46a3914cf325dbdf9290.exe

Drops file in Windows directory 1 IoCs

Processes:

56620b7049d186c16d562f70c45c7ae1783c7c7a4d6c46a3914cf325dbdf9290.exe

description ioc process

File created C:\Windows\Tasks\ThreatKills.job 56620b7049d186c16d562f70c45c7ae1783c7c7a4d6c46a3914cf325dbdf9290.exe

description	ioc	process
File created	C:\Windows\Tasks\ThreatKills.job	56620b7049d186c16d562f70c45c7ae1783c7c7a4d6c46a3914cf325dbdf9290.exe

C:\Users\Admin\AppData\Local\Temp\56620b7049d186c16d562f70c45c7ae1783c7c7a4d6c46a3914cf325dbdf9290.exe
"C:\Users\Admin\AppData\Local\Temp\56620b7049d186c16d562f70c45c7ae1783c7c7a4d6c46a3914cf325dbdf9290.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:2668

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2668-130-0x0000000004CB0000-0x0000000004CDF000-memory.dmp

Filesize
188KB

Download
memory/2668-134-0x0000000005910000-0x0000000005937000-memory.dmp

Filesize
156KB

Download