4530d62b567a82f9dc887543060a2f9bc482114aa6d072e2ad08d64c759bd7ce

Analysis

max time kernel
110s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 13:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4530d62b567a82f9dc887543060a2f9bc482114aa6d072e2ad08d64c759bd7ce.exe
Size

317KB
MD5

49fb5b914e1407888b2d6666d9127a2c
SHA1

a990bbbad0a2602cf3bdafdde3e62c5dcfb90e17
SHA256

4530d62b567a82f9dc887543060a2f9bc482114aa6d072e2ad08d64c759bd7ce
SHA512

78ba969fd46860f042fe5057a3075ec2c1f4e3971e62dc5c386817c6d7c06006c76a36a58a4786884417c39e529f546316b37caa1fa611d8cc22a4849245d166
SSDEEP

6144:gmx6BPNqkxOm1ybeWthLwJNDt3wCtonYHdLda0:gmxo1vOmAbeXJNWCtonUda0

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	4530d62b567a82f9dc887543060a2f9bc482114aa6d072e2ad08d64c759bd7ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	4530d62b567a82f9dc887543060a2f9bc482114aa6d072e2ad08d64c759bd7ce.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\StoragePlus.job	4530d62b567a82f9dc887543060a2f9bc482114aa6d072e2ad08d64c759bd7ce.exe

C:\Users\Admin\AppData\Local\Temp\4530d62b567a82f9dc887543060a2f9bc482114aa6d072e2ad08d64c759bd7ce.exe
"C:\Users\Admin\AppData\Local\Temp\4530d62b567a82f9dc887543060a2f9bc482114aa6d072e2ad08d64c759bd7ce.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:5080

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5080-132-0x0000000001A40000-0x0000000001A6F000-memory.dmp

Filesize
188KB

Download
memory/5080-136-0x0000000005B30000-0x0000000005B57000-memory.dmp

Filesize
156KB

Download