d0d646c2729270678e4b75cc161cf610d6920e459281eac37cdb0b77f737865c

Analysis

max time kernel
148s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0d646c2729270678e4b75cc161cf610d6920e459281eac37cdb0b77f737865c.exe
Size

344KB
MD5

698d141a5bcfadce4592d12d0af23739
SHA1

68f40da6a0c89128eaafdb632dbf555a838fd0c8
SHA256

d0d646c2729270678e4b75cc161cf610d6920e459281eac37cdb0b77f737865c
SHA512

bd74807f3a24c3efc7f2dfd84cde0a97104cea0b010e898a04de6fda79ef61be9e100f36374cbb4fdb32a987efdf4c9f1f3463e1fa4ffec0de8dcd057d26a2e7
SSDEEP

6144:Tt0J6q3DSMn9gxy0ENsQ252eDcB4Yg+Nd7iKTNQ6Ad4Zl7Tlrc8ZF:aJ6ozWhYsQ20eDK4YZcKpTAd4Zl7Tlr3

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	d0d646c2729270678e4b75cc161cf610d6920e459281eac37cdb0b77f737865c.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	d0d646c2729270678e4b75cc161cf610d6920e459281eac37cdb0b77f737865c.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Navig8.job	d0d646c2729270678e4b75cc161cf610d6920e459281eac37cdb0b77f737865c.exe

C:\Users\Admin\AppData\Local\Temp\d0d646c2729270678e4b75cc161cf610d6920e459281eac37cdb0b77f737865c.exe
"C:\Users\Admin\AppData\Local\Temp\d0d646c2729270678e4b75cc161cf610d6920e459281eac37cdb0b77f737865c.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:5020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5020-132-0x0000000000140000-0x000000000017B000-memory.dmp

Filesize
236KB

Download
memory/5020-133-0x0000000000970000-0x000000000099F000-memory.dmp

Filesize
188KB

Download
memory/5020-137-0x0000000006D40000-0x0000000006D67000-memory.dmp

Filesize
156KB

Download
memory/5020-141-0x0000000000140000-0x000000000017B000-memory.dmp

Filesize
236KB

Download