57e4f5047ac3f2f016c0b8bbf9bf045fa744c98e739617998ae622d30faa8ec6

Analysis

max time kernel
18s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 14:35

Target

57e4f5047ac3f2f016c0b8bbf9bf045fa744c98e739617998ae622d30faa8ec6.exe
Size

209KB
MD5

54d4342570ed52d0ffad2e3220d5f6d3
SHA1

3909c1c9e881638d386a6fc0ff92db50bde3b86b
SHA256

57e4f5047ac3f2f016c0b8bbf9bf045fa744c98e739617998ae622d30faa8ec6
SHA512

814f1d652c2692f64a17df27604c83ac050f8688ff49c7612b4304db878f3eb6d045cea71bded58e852e66f1a7f9132e36f6189682039dff0817f5a999efe953
SSDEEP

3072:n7bAhIMIPXT3UEhgaQyf7ZCABo/3T40vUVIJ:nHAh+73OVswABo/31

Score

6^/10

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	57e4f5047ac3f2f016c0b8bbf9bf045fa744c98e739617998ae622d30faa8ec6.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	57e4f5047ac3f2f016c0b8bbf9bf045fa744c98e739617998ae622d30faa8ec6.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
860	57e4f5047ac3f2f016c0b8bbf9bf045fa744c98e739617998ae622d30faa8ec6.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/860-54-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/860-55-0x0000000000220000-0x000000000024F000-memory.dmp

Filesize
188KB

Download
memory/860-56-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download