19c55a28bbe798c0b35522303f9a8997e8a706bd7b0db340348b17b0a52d6967

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 20:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

19c55a28bbe798c0b35522303f9a8997e8a706bd7b0db340348b17b0a52d6967.exe
Size

31KB
MD5

695fea97f896dcda4de186a2778cea30
SHA1

15c34873befa663cf75132a97910913729923141
SHA256

19c55a28bbe798c0b35522303f9a8997e8a706bd7b0db340348b17b0a52d6967
SHA512

11160a484e5f5e21135c2b29320a4285f4d288d37092e28cc64f05a372573602a97ff68edccb470788d44d1c0d213fb2085f51a60073c6b79b13147463188993
SSDEEP

768:acXyb6WAkJqCnsJLpbufHMnCwD15uPw7tor4+zXR:alb2qqCgFufB1Pw7vwB

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	19c55a28bbe798c0b35522303f9a8997e8a706bd7b0db340348b17b0a52d6967.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	19c55a28bbe798c0b35522303f9a8997e8a706bd7b0db340348b17b0a52d6967.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2296 set thread context of 868	2296	19c55a28bbe798c0b35522303f9a8997e8a706bd7b0db340348b17b0a52d6967.exe	88

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2296	19c55a28bbe798c0b35522303f9a8997e8a706bd7b0db340348b17b0a52d6967.exe
868	19c55a28bbe798c0b35522303f9a8997e8a706bd7b0db340348b17b0a52d6967.exe
868	19c55a28bbe798c0b35522303f9a8997e8a706bd7b0db340348b17b0a52d6967.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 868	2296	19c55a28bbe798c0b35522303f9a8997e8a706bd7b0db340348b17b0a52d6967.exe	88
PID 2296 wrote to memory of 868	2296	19c55a28bbe798c0b35522303f9a8997e8a706bd7b0db340348b17b0a52d6967.exe	88
PID 2296 wrote to memory of 868	2296	19c55a28bbe798c0b35522303f9a8997e8a706bd7b0db340348b17b0a52d6967.exe	88
PID 2296 wrote to memory of 868	2296	19c55a28bbe798c0b35522303f9a8997e8a706bd7b0db340348b17b0a52d6967.exe	88
PID 2296 wrote to memory of 868	2296	19c55a28bbe798c0b35522303f9a8997e8a706bd7b0db340348b17b0a52d6967.exe	88
PID 2296 wrote to memory of 868	2296	19c55a28bbe798c0b35522303f9a8997e8a706bd7b0db340348b17b0a52d6967.exe	88
PID 2296 wrote to memory of 868	2296	19c55a28bbe798c0b35522303f9a8997e8a706bd7b0db340348b17b0a52d6967.exe	88
PID 2296 wrote to memory of 868	2296	19c55a28bbe798c0b35522303f9a8997e8a706bd7b0db340348b17b0a52d6967.exe	88
PID 2296 wrote to memory of 868	2296	19c55a28bbe798c0b35522303f9a8997e8a706bd7b0db340348b17b0a52d6967.exe	88

C:\Users\Admin\AppData\Local\Temp\19c55a28bbe798c0b35522303f9a8997e8a706bd7b0db340348b17b0a52d6967.exe
"C:\Users\Admin\AppData\Local\Temp\19c55a28bbe798c0b35522303f9a8997e8a706bd7b0db340348b17b0a52d6967.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Users\Admin\AppData\Local\Temp\19c55a28bbe798c0b35522303f9a8997e8a706bd7b0db340348b17b0a52d6967.exe
  f|
  2⤵
  - Maps connected drives based on registry
  - Suspicious use of SetWindowsHookEx
  PID:868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/868-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/868-137-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/868-141-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download