034310b5c780ee8cfd6fdf3c2611f419e65fae63747f693193c9838189f3d07d

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 20:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

034310b5c780ee8cfd6fdf3c2611f419e65fae63747f693193c9838189f3d07d.exe
Size

257KB
MD5

46ce6fe59875309b9abfd640e3a397a0
SHA1

f09328916ea5c327cbb90643926f2d3643cdf737
SHA256

034310b5c780ee8cfd6fdf3c2611f419e65fae63747f693193c9838189f3d07d
SHA512

57848c1c7e19324822ed0109579bca97a69b983e57fd9206dbf18a85329b9dfc8f5461a609ffa19ce4650e5ba585b7cd68a93f2c17e0a8dd6b27784ff75e0c26
SSDEEP

3072:KsrFhHkffyza7szojIkitAj19Rc9awAYd3hkFskeNzmZEQuWx/rJnGHIlzVu:PF5nbHe3R+awAQxkFhes2QuU/1YgzVu

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	034310b5c780ee8cfd6fdf3c2611f419e65fae63747f693193c9838189f3d07d.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	034310b5c780ee8cfd6fdf3c2611f419e65fae63747f693193c9838189f3d07d.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\SpaceUpgrade.job	034310b5c780ee8cfd6fdf3c2611f419e65fae63747f693193c9838189f3d07d.exe

C:\Users\Admin\AppData\Local\Temp\034310b5c780ee8cfd6fdf3c2611f419e65fae63747f693193c9838189f3d07d.exe
"C:\Users\Admin\AppData\Local\Temp\034310b5c780ee8cfd6fdf3c2611f419e65fae63747f693193c9838189f3d07d.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:1484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1484-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1484-55-0x00000000001C0000-0x00000000001EF000-memory.dmp

Filesize
188KB

Download
memory/1484-59-0x0000000000250000-0x0000000000277000-memory.dmp

Filesize
156KB

Download