f424de070982ce74d25326985c56c2bf2a0f5a64e90caf822fe9fa632d02993e

Analysis

max time kernel
90s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 20:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f424de070982ce74d25326985c56c2bf2a0f5a64e90caf822fe9fa632d02993e.exe
Size

332KB
MD5

00bc3ce6fd6b7cde238200fb70ffc0a1
SHA1

7f1b2dc4cbdca29f1428f59a049399dcf92496f6
SHA256

f424de070982ce74d25326985c56c2bf2a0f5a64e90caf822fe9fa632d02993e
SHA512

1d32e7d34a894e21d9b6cfa35ad9d0c9c9208cfd0db509d49ecfb544c9d8752ddc7a19b842511c2103026e8ff3053283c8cf38d11beb28a73b557be7998bf03b
SSDEEP

6144:WW/g0x4bD15DhGp4C18BmY9H4rmN19GKyPIp:WR0+Lct+mYcSHyAp

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	f424de070982ce74d25326985c56c2bf2a0f5a64e90caf822fe9fa632d02993e.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	f424de070982ce74d25326985c56c2bf2a0f5a64e90caf822fe9fa632d02993e.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\LetterFocus.job	f424de070982ce74d25326985c56c2bf2a0f5a64e90caf822fe9fa632d02993e.exe

C:\Users\Admin\AppData\Local\Temp\f424de070982ce74d25326985c56c2bf2a0f5a64e90caf822fe9fa632d02993e.exe
"C:\Users\Admin\AppData\Local\Temp\f424de070982ce74d25326985c56c2bf2a0f5a64e90caf822fe9fa632d02993e.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:2704

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2704-132-0x0000000000840000-0x000000000087B000-memory.dmp

Filesize
236KB

Download
memory/2704-133-0x0000000000980000-0x00000000009AF000-memory.dmp

Filesize
188KB

Download
memory/2704-137-0x0000000003E20000-0x0000000003E47000-memory.dmp

Filesize
156KB

Download
memory/2704-141-0x0000000000840000-0x000000000087B000-memory.dmp

Filesize
236KB

Download