3746d65b48c70170068a023d1449fe8519db4ba33d84061b39d8ae8177d9604c

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 14:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3746d65b48c70170068a023d1449fe8519db4ba33d84061b39d8ae8177d9604c.exe
Size

324KB
MD5

617e501351681d367d3ec393ba349c79
SHA1

e4de596e67c05453f800ba3fa6a9a137fa67a125
SHA256

3746d65b48c70170068a023d1449fe8519db4ba33d84061b39d8ae8177d9604c
SHA512

15d2e406d619405e36ee357d90b44e5e4d4487316e4d21994cfd7e23f9b3096ca458266082d269814d94f7885303978f4c6680cdbc99329cf68a71e0ad2e8458
SSDEEP

6144:pzYsqibQRYb8SCyrXzWgUGqmEodXSmE4+XWB8hHGxEcj:mPVRk8SCyjzWg5qx0XSmSWBWiEcj

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	3746d65b48c70170068a023d1449fe8519db4ba33d84061b39d8ae8177d9604c.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	3746d65b48c70170068a023d1449fe8519db4ba33d84061b39d8ae8177d9604c.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\HuskyKey.job	3746d65b48c70170068a023d1449fe8519db4ba33d84061b39d8ae8177d9604c.exe

C:\Users\Admin\AppData\Local\Temp\3746d65b48c70170068a023d1449fe8519db4ba33d84061b39d8ae8177d9604c.exe
"C:\Users\Admin\AppData\Local\Temp\3746d65b48c70170068a023d1449fe8519db4ba33d84061b39d8ae8177d9604c.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/860-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/860-55-0x0000000000230000-0x000000000025F000-memory.dmp

Filesize
188KB

Download
memory/860-59-0x00000000002A0000-0x00000000002C7000-memory.dmp

Filesize
156KB

Download
memory/860-63-0x0000000000151000-0x000000000017B000-memory.dmp

Filesize
168KB

Download