55f3cbcaa6d810500eafcb38964edabf3448acdd856b480af3548f3a00c8c063

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2022 06:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55f3cbcaa6d810500eafcb38964edabf3448acdd856b480af3548f3a00c8c063.exe
Size

245KB
MD5

2711ed38244626962bd768e14fe98828
SHA1

84e2e522ef8deb105ea16bb2d07b34d5cd809077
SHA256

55f3cbcaa6d810500eafcb38964edabf3448acdd856b480af3548f3a00c8c063
SHA512

1475fff672c42b07a940631321ab8a718be4b00e8ff7650aa567cd530b6f10216ce51c3cb2f504704189d0204bd379f49cd4343e021c2e0aa6c8b0a69cc77efc

Score

10^/10

suricata

Malware Config

Signatures

suricata: ET MALWARE ETag HTTP Header Observed at JPCERT Sinkhole
suricata: ET MALWARE ETag HTTP Header Observed at JPCERT Sinkhole
suricata

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

55f3cbcaa6d810500eafcb38964edabf3448acdd856b480af3548f3a00c8c063.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	55f3cbcaa6d810500eafcb38964edabf3448acdd856b480af3548f3a00c8c063.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	55f3cbcaa6d810500eafcb38964edabf3448acdd856b480af3548f3a00c8c063.exe

Drops file in Windows directory 1 IoCs

Processes:

55f3cbcaa6d810500eafcb38964edabf3448acdd856b480af3548f3a00c8c063.exe

description	ioc	process
File created	C:\Windows\Tasks\Bidaily Synchronize Task[973b].job	55f3cbcaa6d810500eafcb38964edabf3448acdd856b480af3548f3a00c8c063.exe

C:\Users\Admin\AppData\Local\Temp\55f3cbcaa6d810500eafcb38964edabf3448acdd856b480af3548f3a00c8c063.exe
"C:\Users\Admin\AppData\Local\Temp\55f3cbcaa6d810500eafcb38964edabf3448acdd856b480af3548f3a00c8c063.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:2920

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2920-130-0x0000000000C90000-0x0000000000CBF000-memory.dmp

Filesize
188KB

Download
memory/2920-134-0x0000000000D00000-0x0000000000D27000-memory.dmp

Filesize
156KB

Download
memory/2920-138-0x0000000000790000-0x00000000007B9000-memory.dmp

Filesize
164KB

Download
memory/2920-139-0x0000000000790000-0x00000000007B9000-memory.dmp

Filesize
164KB

Download
memory/2920-140-0x0000000000790000-0x00000000007B9000-memory.dmp

Filesize
164KB

Download