562077d8a074b09a74cb513a4ec45adae0aa4147ee184587f8950b4b8c05c706

Analysis

max time kernel
91s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2022 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

562077d8a074b09a74cb513a4ec45adae0aa4147ee184587f8950b4b8c05c706.exe
Size

257KB
MD5

42ede43db9c1bc63906b8f5421d3e8b7
SHA1

2f115b40f97101375055f6dc1bba4ef60faed74f
SHA256

562077d8a074b09a74cb513a4ec45adae0aa4147ee184587f8950b4b8c05c706
SHA512

41ac297f2761c8177be10d8047a6896792e22d1610d0197739c7333728e0927de5a1f446823f7b942bccca43823590b4e4c85b80298b461e1dde1b310b43673f

Score

10^/10

suricata

Malware Config

Signatures

suricata: ET MALWARE ETag HTTP Header Observed at JPCERT Sinkhole
suricata: ET MALWARE ETag HTTP Header Observed at JPCERT Sinkhole
suricata

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

562077d8a074b09a74cb513a4ec45adae0aa4147ee184587f8950b4b8c05c706.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	562077d8a074b09a74cb513a4ec45adae0aa4147ee184587f8950b4b8c05c706.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	562077d8a074b09a74cb513a4ec45adae0aa4147ee184587f8950b4b8c05c706.exe

Drops file in Windows directory 1 IoCs

Processes:

562077d8a074b09a74cb513a4ec45adae0aa4147ee184587f8950b4b8c05c706.exe

description ioc process

File created C:\Windows\Tasks\ExpertDevice.job 562077d8a074b09a74cb513a4ec45adae0aa4147ee184587f8950b4b8c05c706.exe

description	ioc	process
File created	C:\Windows\Tasks\ExpertDevice.job	562077d8a074b09a74cb513a4ec45adae0aa4147ee184587f8950b4b8c05c706.exe

C:\Users\Admin\AppData\Local\Temp\562077d8a074b09a74cb513a4ec45adae0aa4147ee184587f8950b4b8c05c706.exe
"C:\Users\Admin\AppData\Local\Temp\562077d8a074b09a74cb513a4ec45adae0aa4147ee184587f8950b4b8c05c706.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:784

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/784-130-0x0000000001690000-0x00000000016BF000-memory.dmp

Filesize
188KB

Download
memory/784-134-0x00000000016C0000-0x00000000016E7000-memory.dmp

Filesize
156KB

Download