a1b530819dfa144ed87510ac3ef24108860836eafaf9d0f6f7ccd14d41c38513

Analysis

max time kernel
137s
max time network
160s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 13:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1b530819dfa144ed87510ac3ef24108860836eafaf9d0f6f7ccd14d41c38513.exe
Size

318KB
MD5

7bee4e5fe7dc211ac2f139732569c009
SHA1

442f65561f097d1630b215f28b88ea1f8e758cab
SHA256

a1b530819dfa144ed87510ac3ef24108860836eafaf9d0f6f7ccd14d41c38513
SHA512

4cc564e993390dc58c1509d6a068b8e9943fc200c27b4e2dc40174cb69b11f1c23ae46cb792dae7119b533e14c94b8398c525ef2bc18539335d01a3970f25740
SSDEEP

6144:OZP+lR74jyQZdo5V/0G1sxYcyHOS0wjQOtawILa:OZ+P7sXY0/xc0wjQsILa

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	a1b530819dfa144ed87510ac3ef24108860836eafaf9d0f6f7ccd14d41c38513.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	a1b530819dfa144ed87510ac3ef24108860836eafaf9d0f6f7ccd14d41c38513.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\MileCalc.job	a1b530819dfa144ed87510ac3ef24108860836eafaf9d0f6f7ccd14d41c38513.exe

C:\Users\Admin\AppData\Local\Temp\a1b530819dfa144ed87510ac3ef24108860836eafaf9d0f6f7ccd14d41c38513.exe
"C:\Users\Admin\AppData\Local\Temp\a1b530819dfa144ed87510ac3ef24108860836eafaf9d0f6f7ccd14d41c38513.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:1624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1624-54-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/1624-55-0x0000000000370000-0x000000000039F000-memory.dmp

Filesize
188KB

Download
memory/1624-59-0x00000000003A0000-0x00000000003C7000-memory.dmp

Filesize
156KB

Download