1eaa4eab85d09deaccc10d639928b44c4173cf49ededf6028ed1aaee2a4eacd7

Analysis

max time kernel
52s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 21:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1eaa4eab85d09deaccc10d639928b44c4173cf49ededf6028ed1aaee2a4eacd7.exe
Size

318KB
MD5

6ffbbccb525a1df91c6df0597c22225f
SHA1

852f600a5c03be716194af0ca9fe0cd3a17de257
SHA256

1eaa4eab85d09deaccc10d639928b44c4173cf49ededf6028ed1aaee2a4eacd7
SHA512

363db23a82b79ac1a16113ff30f5269a29816cfba61b39034b1e4512c3bd49c04eac4f4730264edd15fe6beed3fcebd42e8b870dbce11cf5b392fa1706936342
SSDEEP

6144:P+2HNqEO7ze0ESuyrp5NT9P8O2xRl1tL7cfmatuR:P+ENW/bEc3M/PtLCDtuR

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	1eaa4eab85d09deaccc10d639928b44c4173cf49ededf6028ed1aaee2a4eacd7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	1eaa4eab85d09deaccc10d639928b44c4173cf49ededf6028ed1aaee2a4eacd7.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\DragonFiles.job	1eaa4eab85d09deaccc10d639928b44c4173cf49ededf6028ed1aaee2a4eacd7.exe

C:\Users\Admin\AppData\Local\Temp\1eaa4eab85d09deaccc10d639928b44c4173cf49ededf6028ed1aaee2a4eacd7.exe
"C:\Users\Admin\AppData\Local\Temp\1eaa4eab85d09deaccc10d639928b44c4173cf49ededf6028ed1aaee2a4eacd7.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/644-132-0x00000000009E0000-0x0000000000A0F000-memory.dmp

Filesize
188KB

Download
memory/644-136-0x00000000049F0000-0x0000000004A17000-memory.dmp

Filesize
156KB

Download