d817f16e27afd3992caace9069c9eb5537a37a033b07ddbdb48349042d8875bd

Analysis

max time kernel
172s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-10-2022 21:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d817f16e27afd3992caace9069c9eb5537a37a033b07ddbdb48349042d8875bd.exe
Size

188KB
MD5

4066462fba573cc2e8381dc90d0f387a
SHA1

94902cc503327e036cd6ee58955c48f012aa5f03
SHA256

d817f16e27afd3992caace9069c9eb5537a37a033b07ddbdb48349042d8875bd
SHA512

ae4840eceb94d97daa7decb38c8ce0887583d130fe0caa2635cbd8129165de98debb2f8e9fc353f251cf176ff2ed5fa0204398e3b47bf519ebc5a2aaae55fdab
SSDEEP

1536:A6V/PXeTq2PMiNyAvWzdJWIeeNG97H22DvHnL0yc9WirloM23K:BeTq6PqteeY97HTDvHL0yTirlo

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	d817f16e27afd3992caace9069c9eb5537a37a033b07ddbdb48349042d8875bd.exe
File opened (read-only)	\??\R:	d817f16e27afd3992caace9069c9eb5537a37a033b07ddbdb48349042d8875bd.exe
File opened (read-only)	\??\E:	d817f16e27afd3992caace9069c9eb5537a37a033b07ddbdb48349042d8875bd.exe
File opened (read-only)	\??\G:	d817f16e27afd3992caace9069c9eb5537a37a033b07ddbdb48349042d8875bd.exe
File opened (read-only)	\??\H:	d817f16e27afd3992caace9069c9eb5537a37a033b07ddbdb48349042d8875bd.exe
File opened (read-only)	\??\I:	d817f16e27afd3992caace9069c9eb5537a37a033b07ddbdb48349042d8875bd.exe
File opened (read-only)	\??\K:	d817f16e27afd3992caace9069c9eb5537a37a033b07ddbdb48349042d8875bd.exe
File opened (read-only)	\??\J:	d817f16e27afd3992caace9069c9eb5537a37a033b07ddbdb48349042d8875bd.exe
File opened (read-only)	\??\M:	d817f16e27afd3992caace9069c9eb5537a37a033b07ddbdb48349042d8875bd.exe
File opened (read-only)	\??\O:	d817f16e27afd3992caace9069c9eb5537a37a033b07ddbdb48349042d8875bd.exe
File opened (read-only)	\??\P:	d817f16e27afd3992caace9069c9eb5537a37a033b07ddbdb48349042d8875bd.exe
File opened (read-only)	\??\S:	d817f16e27afd3992caace9069c9eb5537a37a033b07ddbdb48349042d8875bd.exe
File opened (read-only)	\??\Z:	d817f16e27afd3992caace9069c9eb5537a37a033b07ddbdb48349042d8875bd.exe
File opened (read-only)	\??\N:	d817f16e27afd3992caace9069c9eb5537a37a033b07ddbdb48349042d8875bd.exe
File opened (read-only)	\??\Q:	d817f16e27afd3992caace9069c9eb5537a37a033b07ddbdb48349042d8875bd.exe
File opened (read-only)	\??\T:	d817f16e27afd3992caace9069c9eb5537a37a033b07ddbdb48349042d8875bd.exe
File opened (read-only)	\??\W:	d817f16e27afd3992caace9069c9eb5537a37a033b07ddbdb48349042d8875bd.exe
File opened (read-only)	\??\X:	d817f16e27afd3992caace9069c9eb5537a37a033b07ddbdb48349042d8875bd.exe
File opened (read-only)	\??\F:	d817f16e27afd3992caace9069c9eb5537a37a033b07ddbdb48349042d8875bd.exe
File opened (read-only)	\??\U:	d817f16e27afd3992caace9069c9eb5537a37a033b07ddbdb48349042d8875bd.exe
File opened (read-only)	\??\V:	d817f16e27afd3992caace9069c9eb5537a37a033b07ddbdb48349042d8875bd.exe
File opened (read-only)	\??\Y:	d817f16e27afd3992caace9069c9eb5537a37a033b07ddbdb48349042d8875bd.exe

C:\Users\Admin\AppData\Local\Temp\d817f16e27afd3992caace9069c9eb5537a37a033b07ddbdb48349042d8875bd.exe
"C:\Users\Admin\AppData\Local\Temp\d817f16e27afd3992caace9069c9eb5537a37a033b07ddbdb48349042d8875bd.exe"
1⤵
- Enumerates connected drives
PID:1560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1560-54-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1560-55-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download