305f599fa18f8a67904bb051ef13075c49e42ed96d910d00416cdf5ca799b363

Analysis

max time kernel
144s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2022 13:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

305f599fa18f8a67904bb051ef13075c49e42ed96d910d00416cdf5ca799b363.exe
Size

332KB
MD5

71af0cd406c9ed3b0f5d7dd348c40f53
SHA1

02555656f294e7101c90b1f4102e9fac6cd1dbaf
SHA256

305f599fa18f8a67904bb051ef13075c49e42ed96d910d00416cdf5ca799b363
SHA512

8ef5db6970236a8eef28094a631d01450cc5acf980012d78cd017de5a24f0840e7300648bd88c01b0dd1c5fbe1b081c61cfdad35bc906699c38740ccd3c05005
SSDEEP

6144:GVQRCcBWl9qAJo5SVTJwtdPgRQsM/Q4tNZNebxDTZR59O2b:FRoKekxr/Q4tPNeBTF9O2b

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	305f599fa18f8a67904bb051ef13075c49e42ed96d910d00416cdf5ca799b363.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	305f599fa18f8a67904bb051ef13075c49e42ed96d910d00416cdf5ca799b363.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\DogBytes.job	305f599fa18f8a67904bb051ef13075c49e42ed96d910d00416cdf5ca799b363.exe

C:\Users\Admin\AppData\Local\Temp\305f599fa18f8a67904bb051ef13075c49e42ed96d910d00416cdf5ca799b363.exe
"C:\Users\Admin\AppData\Local\Temp\305f599fa18f8a67904bb051ef13075c49e42ed96d910d00416cdf5ca799b363.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:3844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3844-132-0x0000000000840000-0x000000000087B000-memory.dmp

Filesize
236KB

Download
memory/3844-133-0x0000000001B90000-0x0000000001BBF000-memory.dmp

Filesize
188KB

Download
memory/3844-137-0x0000000004A40000-0x0000000004A67000-memory.dmp

Filesize
156KB

Download
memory/3844-141-0x0000000000840000-0x000000000087B000-memory.dmp

Filesize
236KB

Download
memory/3844-142-0x0000000000840000-0x000000000087B000-memory.dmp

Filesize
236KB

Download