31e4fcb79313874b970b2126018db2d9040ef535ae1de12ebaacaf631f55eef6

Analysis

max time kernel
147s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 15:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31e4fcb79313874b970b2126018db2d9040ef535ae1de12ebaacaf631f55eef6.exe
Size

261KB
MD5

10b61ec70c36760995c022fd4ed09a16
SHA1

4cf4ac464dd42a9627733d403878c70acc6a447f
SHA256

31e4fcb79313874b970b2126018db2d9040ef535ae1de12ebaacaf631f55eef6
SHA512

3508d98db13abf1a02bf62ff4f04017353e0cbe02ed1f84b245060f32bb7bc31cdf2681eb894b26018025d436b9210c8e3bc477768783d30bcc29ab189af2a9f
SSDEEP

6144:DOK4C59Y9k/P59SHn/2DrrTF24kgl6Oqrn9BXG:DOK4uB5wHnSHB2Ngl6Oqrn9BXG

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	31e4fcb79313874b970b2126018db2d9040ef535ae1de12ebaacaf631f55eef6.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	31e4fcb79313874b970b2126018db2d9040ef535ae1de12ebaacaf631f55eef6.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\CosmoAnimation.job	31e4fcb79313874b970b2126018db2d9040ef535ae1de12ebaacaf631f55eef6.exe

C:\Users\Admin\AppData\Local\Temp\31e4fcb79313874b970b2126018db2d9040ef535ae1de12ebaacaf631f55eef6.exe
"C:\Users\Admin\AppData\Local\Temp\31e4fcb79313874b970b2126018db2d9040ef535ae1de12ebaacaf631f55eef6.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:4640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4640-132-0x00000000009E0000-0x0000000000A0F000-memory.dmp

Filesize
188KB

Download
memory/4640-136-0x0000000000A80000-0x0000000000AA7000-memory.dmp

Filesize
156KB

Download