c18b4761ba9056221870186a6a59dc989959ecc8f8a99892564512659a241a1a

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 15:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c18b4761ba9056221870186a6a59dc989959ecc8f8a99892564512659a241a1a.exe
Size

261KB
MD5

fddf8a7c124c3a5e6384de64fd610c42
SHA1

50b2be2d391413ff02064d87a09962c39b0adf41
SHA256

c18b4761ba9056221870186a6a59dc989959ecc8f8a99892564512659a241a1a
SHA512

d222fa3e3801c4a24f92df11979f8a45d15760a64ca1bb2b332683dd1216f4709c61a073c63abba8ae49728f13de9e331fe0cb8a4743ceda4a1ea83d72b38982
SSDEEP

6144:pzvQ5oA1JQc91Wn/e9Lb6DFSxEY0tPTlCY3K:pzvQ91EW9wF7CY3K

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	c18b4761ba9056221870186a6a59dc989959ecc8f8a99892564512659a241a1a.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	c18b4761ba9056221870186a6a59dc989959ecc8f8a99892564512659a241a1a.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\MedReminder.job	c18b4761ba9056221870186a6a59dc989959ecc8f8a99892564512659a241a1a.exe

C:\Users\Admin\AppData\Local\Temp\c18b4761ba9056221870186a6a59dc989959ecc8f8a99892564512659a241a1a.exe
"C:\Users\Admin\AppData\Local\Temp\c18b4761ba9056221870186a6a59dc989959ecc8f8a99892564512659a241a1a.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/620-54-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download
memory/620-55-0x00000000005C0000-0x00000000005EF000-memory.dmp

Filesize
188KB

Download
memory/620-59-0x0000000000730000-0x0000000000757000-memory.dmp

Filesize
156KB

Download