9d425c92f6062801a9fd3875997a5afef00a73a97dafed411e0203f716d3563f

Analysis

max time kernel
157s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 10:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9d425c92f6062801a9fd3875997a5afef00a73a97dafed411e0203f716d3563f.exe
Size

365KB
MD5

fd51d39c2c379a13dfade67e8f13b11f
SHA1

3bbf8b6eddfd79ebe4f3af0bf837746f55f2b7df
SHA256

9d425c92f6062801a9fd3875997a5afef00a73a97dafed411e0203f716d3563f
SHA512

4eef5b273fab0e735c52d668187c1e4e3188b2d259fd469fff4ecd06a7a14784093762ef8a907f5f5ffe3656e6e9ef6e3f225b8dec3ee9a3724bcc0de9b2576f
SSDEEP

6144:uOhfwjyY9lvE5k7cwwo6CJnvibjrVaYqaoU51Z32wbJ98diYE53Xr:u2fwuVyvw/VaYqq51x27E53Xr

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	9d425c92f6062801a9fd3875997a5afef00a73a97dafed411e0203f716d3563f.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	9d425c92f6062801a9fd3875997a5afef00a73a97dafed411e0203f716d3563f.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\FSTask+.job	9d425c92f6062801a9fd3875997a5afef00a73a97dafed411e0203f716d3563f.exe

C:\Users\Admin\AppData\Local\Temp\9d425c92f6062801a9fd3875997a5afef00a73a97dafed411e0203f716d3563f.exe
"C:\Users\Admin\AppData\Local\Temp\9d425c92f6062801a9fd3875997a5afef00a73a97dafed411e0203f716d3563f.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:4888

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4888-132-0x0000000003E30000-0x0000000003E5F000-memory.dmp

Filesize
188KB

Download
memory/4888-136-0x0000000006000000-0x0000000006027000-memory.dmp

Filesize
156KB

Download