163886e3d93063f346816649040a7cca759bc649069b999e84442cbf0b98421c

Analysis

max time kernel
144s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2022, 18:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

163886e3d93063f346816649040a7cca759bc649069b999e84442cbf0b98421c.exe
Size

341KB
MD5

05e4e9b37f7f19b510e9856ad95e0328
SHA1

59c7b04a53893f540d7415d9ef4538ca8d106b00
SHA256

163886e3d93063f346816649040a7cca759bc649069b999e84442cbf0b98421c
SHA512

14f15b4001500026ad38b5ba2806a63085a520b9ee2bfba5199d78ecbbe55a51042d2752b88dfaaf38beb4b1cfd8107dc091a537fcfc6243fa5751ef07ee8bdb
SSDEEP

6144:syAp1tcPrjr12NoqtrmkWz2tq5qGaJgD0mqoaV4JRQgtn5Q9:hA0fYNoCWzn5yJBoFJR75Q9

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	163886e3d93063f346816649040a7cca759bc649069b999e84442cbf0b98421c.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	163886e3d93063f346816649040a7cca759bc649069b999e84442cbf0b98421c.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\GestureControls.job	163886e3d93063f346816649040a7cca759bc649069b999e84442cbf0b98421c.exe

C:\Users\Admin\AppData\Local\Temp\163886e3d93063f346816649040a7cca759bc649069b999e84442cbf0b98421c.exe
"C:\Users\Admin\AppData\Local\Temp\163886e3d93063f346816649040a7cca759bc649069b999e84442cbf0b98421c.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:3348

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3348-132-0x0000000000840000-0x000000000087B000-memory.dmp

Filesize
236KB

Download
memory/3348-133-0x0000000000980000-0x00000000009AF000-memory.dmp

Filesize
188KB

Download
memory/3348-137-0x0000000006940000-0x0000000006967000-memory.dmp

Filesize
156KB

Download
memory/3348-141-0x0000000000840000-0x000000000087B000-memory.dmp

Filesize
236KB

Download