6f0cde137279117e6378d1ebff0c1a8d6334e05a7a864d712014b1219a5ada54

Analysis

max time kernel
111s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 20:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6f0cde137279117e6378d1ebff0c1a8d6334e05a7a864d712014b1219a5ada54.exe
Size

383KB
MD5

64093346837e083afc8fba5760a2a520
SHA1

8ef1acdf436e9760679058649c3925f072238089
SHA256

6f0cde137279117e6378d1ebff0c1a8d6334e05a7a864d712014b1219a5ada54
SHA512

2ac8d3187bcc7b28c14315eb15580088506cc663802078b1709e2de6a0f8b2ae7497817af1c54fa893fe32a3c94e499b68e042b5579885ad5e9d03168b016e49
SSDEEP

6144:W2W9OmGF6uUa0HCPHje57mj+/tsnvkWXMJRf:W2W9OcCPD5j+lWvkWXMJRf

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	6f0cde137279117e6378d1ebff0c1a8d6334e05a7a864d712014b1219a5ada54.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	6f0cde137279117e6378d1ebff0c1a8d6334e05a7a864d712014b1219a5ada54.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\PocketScanner.job	6f0cde137279117e6378d1ebff0c1a8d6334e05a7a864d712014b1219a5ada54.exe

C:\Users\Admin\AppData\Local\Temp\6f0cde137279117e6378d1ebff0c1a8d6334e05a7a864d712014b1219a5ada54.exe
"C:\Users\Admin\AppData\Local\Temp\6f0cde137279117e6378d1ebff0c1a8d6334e05a7a864d712014b1219a5ada54.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:5072

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5072-132-0x0000000003E00000-0x0000000003E2F000-memory.dmp

Filesize
188KB

Download
memory/5072-136-0x0000000005FB0000-0x0000000005FD7000-memory.dmp

Filesize
156KB

Download