a644f918d3f26af538c0572df9e33df944e35883050118767b8aef58150e48c2

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-10-2022 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a644f918d3f26af538c0572df9e33df944e35883050118767b8aef58150e48c2.exe
Size

318KB
MD5

7627fff22d774a6d56dc20d5e2cb4e19
SHA1

a29540100dcbc45c26c38a3724805860d13b2bbf
SHA256

a644f918d3f26af538c0572df9e33df944e35883050118767b8aef58150e48c2
SHA512

64ebd9e183b3542f4d3caa13bf5ad6611e13eababaf1fc7e920467ccc65d1961825523c585ad3eb574ff768648c492478248231d5840c1ce06db779fdd2cf295
SSDEEP

6144:NOANBs8P6Itg0uOGE3yVOfeD5NBtF2EU3FQgWH5/:N3NS8PBy4mMeDFnU1Qgq/

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	a644f918d3f26af538c0572df9e33df944e35883050118767b8aef58150e48c2.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	a644f918d3f26af538c0572df9e33df944e35883050118767b8aef58150e48c2.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\SleepCycle+.job	a644f918d3f26af538c0572df9e33df944e35883050118767b8aef58150e48c2.exe

C:\Users\Admin\AppData\Local\Temp\a644f918d3f26af538c0572df9e33df944e35883050118767b8aef58150e48c2.exe
"C:\Users\Admin\AppData\Local\Temp\a644f918d3f26af538c0572df9e33df944e35883050118767b8aef58150e48c2.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:1112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1112-54-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download
memory/1112-55-0x0000000000370000-0x000000000039F000-memory.dmp

Filesize
188KB

Download
memory/1112-59-0x0000000004930000-0x0000000004957000-memory.dmp

Filesize
156KB

Download