fe2f13b79fc9e7dd84ad5d3e08e292a5cb9ba9b3b187422f6fbb81efeac4d3a2

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 13:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fe2f13b79fc9e7dd84ad5d3e08e292a5cb9ba9b3b187422f6fbb81efeac4d3a2.exe
Size

217KB
MD5

6909ce4c59da405fc27278c8d3519001
SHA1

4b45bccb465e9a98c5ef39a4d21fa725f191b27c
SHA256

fe2f13b79fc9e7dd84ad5d3e08e292a5cb9ba9b3b187422f6fbb81efeac4d3a2
SHA512

ff17801cb852d7ab511d0778d494fd7e5017fe0b3bcf991ba7946a8d6eda82b77e7879819d7d8d7024977ec65baa6cba37b51acb82b2ba0ace2b86ce1810cb01
SSDEEP

3072:HKem26qM6JD4Yc80ZcaQaTa4yxWj0A/++iym2tBAnBsccqaKZtfxEH:H3m26eD+5Qa+Dojxzi0iPgcmH

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	fe2f13b79fc9e7dd84ad5d3e08e292a5cb9ba9b3b187422f6fbb81efeac4d3a2.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	fe2f13b79fc9e7dd84ad5d3e08e292a5cb9ba9b3b187422f6fbb81efeac4d3a2.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\PhoneBites.job	fe2f13b79fc9e7dd84ad5d3e08e292a5cb9ba9b3b187422f6fbb81efeac4d3a2.exe

C:\Users\Admin\AppData\Local\Temp\fe2f13b79fc9e7dd84ad5d3e08e292a5cb9ba9b3b187422f6fbb81efeac4d3a2.exe
"C:\Users\Admin\AppData\Local\Temp\fe2f13b79fc9e7dd84ad5d3e08e292a5cb9ba9b3b187422f6fbb81efeac4d3a2.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:1724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1724-54-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download
memory/1724-55-0x0000000000170000-0x000000000019F000-memory.dmp

Filesize
188KB

Download
memory/1724-59-0x00000000003D0000-0x00000000003F7000-memory.dmp

Filesize
156KB

Download