38e12e995184a96133d881825380030e4e30e92150a2732b5bd4b88f36c7296b

Analysis

max time kernel
35s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38e12e995184a96133d881825380030e4e30e92150a2732b5bd4b88f36c7296b.exe
Size

261KB
MD5

4f2a151e1c9adf0c669b7bc651bd10a3
SHA1

573860fb7a3c2755d3c4b2e6acba0306da39ef52
SHA256

38e12e995184a96133d881825380030e4e30e92150a2732b5bd4b88f36c7296b
SHA512

e864171df38e4be7e8bb3c7573f6b81a8fff03bcf1f5192b3952532fd9a963ff49949509193ac4f126b4461868d35e0b1d10631f6b7f19b498db547b3786f344
SSDEEP

6144:CVLAhXwR/Jv47eZy2lGP6RwBQM+cyVG31hf1jzf0:QkXFUGP6KxF51ff0

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	38e12e995184a96133d881825380030e4e30e92150a2732b5bd4b88f36c7296b.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	38e12e995184a96133d881825380030e4e30e92150a2732b5bd4b88f36c7296b.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\EasyJotDown.job	38e12e995184a96133d881825380030e4e30e92150a2732b5bd4b88f36c7296b.exe

C:\Users\Admin\AppData\Local\Temp\38e12e995184a96133d881825380030e4e30e92150a2732b5bd4b88f36c7296b.exe
"C:\Users\Admin\AppData\Local\Temp\38e12e995184a96133d881825380030e4e30e92150a2732b5bd4b88f36c7296b.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:1384

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1384-54-0x0000000076DC1000-0x0000000076DC3000-memory.dmp

Filesize
8KB

Download
memory/1384-55-0x00000000005A0000-0x00000000005CF000-memory.dmp

Filesize
188KB

Download
memory/1384-59-0x00000000005D0000-0x00000000005F7000-memory.dmp

Filesize
156KB

Download