55f82f321e08081c0abd3473d5e8b5dac62666fad943b025f8c317923ce23b09

Analysis

max time kernel
52s
max time network
60s
platform
windows10-2004_x64
resource
win10v2004-20220722-en
resource tags

arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2022 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55f82f321e08081c0abd3473d5e8b5dac62666fad943b025f8c317923ce23b09.exe
Size

373KB
MD5

335a3df31fe7c1aac0f42b0fd1505c5e
SHA1

1c04f16186f0419cfac4061ace5d5df0a6c2f654
SHA256

55f82f321e08081c0abd3473d5e8b5dac62666fad943b025f8c317923ce23b09
SHA512

a4e2c74f825bbbdc02daa2a9377e319788713e8a723088322c9648314201276721e5ecd067e809bb47b0fa8a4ea09f67fff724518dfaee2ad9bca7500408d734

Score

10^/10

suricata

Malware Config

Signatures

suricata: ET MALWARE ETag HTTP Header Observed at JPCERT Sinkhole
suricata: ET MALWARE ETag HTTP Header Observed at JPCERT Sinkhole
suricata

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

55f82f321e08081c0abd3473d5e8b5dac62666fad943b025f8c317923ce23b09.exe

description	ioc	process
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	55f82f321e08081c0abd3473d5e8b5dac62666fad943b025f8c317923ce23b09.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	55f82f321e08081c0abd3473d5e8b5dac62666fad943b025f8c317923ce23b09.exe

Drops file in Windows directory 1 IoCs

Processes:

55f82f321e08081c0abd3473d5e8b5dac62666fad943b025f8c317923ce23b09.exe

description ioc process

File created C:\Windows\Tasks\CookieFinder.job 55f82f321e08081c0abd3473d5e8b5dac62666fad943b025f8c317923ce23b09.exe

description	ioc	process
File created	C:\Windows\Tasks\CookieFinder.job	55f82f321e08081c0abd3473d5e8b5dac62666fad943b025f8c317923ce23b09.exe

C:\Users\Admin\AppData\Local\Temp\55f82f321e08081c0abd3473d5e8b5dac62666fad943b025f8c317923ce23b09.exe
"C:\Users\Admin\AppData\Local\Temp\55f82f321e08081c0abd3473d5e8b5dac62666fad943b025f8c317923ce23b09.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:1764

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1764-132-0x00000000009B0000-0x00000000009DF000-memory.dmp

Filesize
188KB

Download
memory/1764-136-0x0000000000A20000-0x0000000000A47000-memory.dmp

Filesize
156KB

Download