9af09a29a2167535a1d2457518b88d9025af46693035b1c1bef997476b5f99e9

Analysis

max time kernel
166s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 14:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9af09a29a2167535a1d2457518b88d9025af46693035b1c1bef997476b5f99e9.exe
Size

323KB
MD5

1dbc37bac41355a9b50dd1905ab3b15f
SHA1

d86069f8a3e2f12c290a46495e5714e0c0d1e100
SHA256

9af09a29a2167535a1d2457518b88d9025af46693035b1c1bef997476b5f99e9
SHA512

4c3b8b3559ada6a90cb20eea487b616c7107e3497229fb13f49ad576b8f264147d1dd623a08d6addfaff2bcacd7deb31fc2b7f6d26cac6e29cf950282139535d
SSDEEP

6144:omc567wc7vptFe+pjrT30WIvuFkBD8Fk23Y32a1Ej/L:S67B7vpPprT32uWBD8Fk2o32a1M/L

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	9af09a29a2167535a1d2457518b88d9025af46693035b1c1bef997476b5f99e9.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	9af09a29a2167535a1d2457518b88d9025af46693035b1c1bef997476b5f99e9.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\EasyWeb.job	9af09a29a2167535a1d2457518b88d9025af46693035b1c1bef997476b5f99e9.exe

C:\Users\Admin\AppData\Local\Temp\9af09a29a2167535a1d2457518b88d9025af46693035b1c1bef997476b5f99e9.exe
"C:\Users\Admin\AppData\Local\Temp\9af09a29a2167535a1d2457518b88d9025af46693035b1c1bef997476b5f99e9.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:4320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4320-132-0x0000000002820000-0x000000000284F000-memory.dmp

Filesize
188KB

Download
memory/4320-136-0x0000000002890000-0x00000000028B7000-memory.dmp

Filesize
156KB

Download
memory/4320-139-0x0000000001F10000-0x0000000002010000-memory.dmp

Filesize
1024KB

Download