747b25d573f6fb2f047f161c27b950e223a28613e9027bae7d09337e1ffbf1af

Analysis

max time kernel
104s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 13:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

747b25d573f6fb2f047f161c27b950e223a28613e9027bae7d09337e1ffbf1af.exe
Size

307KB
MD5

601d08fc48e0c33a8afff0a164712f4e
SHA1

c20eb7ed043418a3c3c440f64872782610d213c2
SHA256

747b25d573f6fb2f047f161c27b950e223a28613e9027bae7d09337e1ffbf1af
SHA512

493038490fb5b7fa4f335bffcd1020764eceaf8a8b365837b75d5afdb2035162afb16001ccce343d31d1df999ce40e571106974a0d83cfd8d82692ea945a0629
SSDEEP

6144:6NBmzRovFPxOWsRXSpU3YEFvjChLYpkEkOkr:0QzRM/q1FWqkr

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	747b25d573f6fb2f047f161c27b950e223a28613e9027bae7d09337e1ffbf1af.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	747b25d573f6fb2f047f161c27b950e223a28613e9027bae7d09337e1ffbf1af.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\MathGeek.job	747b25d573f6fb2f047f161c27b950e223a28613e9027bae7d09337e1ffbf1af.exe

C:\Users\Admin\AppData\Local\Temp\747b25d573f6fb2f047f161c27b950e223a28613e9027bae7d09337e1ffbf1af.exe
"C:\Users\Admin\AppData\Local\Temp\747b25d573f6fb2f047f161c27b950e223a28613e9027bae7d09337e1ffbf1af.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:4448

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4448-132-0x0000000001780000-0x00000000017AF000-memory.dmp

Filesize
188KB

Download
memory/4448-136-0x0000000004D50000-0x0000000004D77000-memory.dmp

Filesize
156KB

Download