40695a2c7c6dec48e6967bf2758794514f68d2e337111e60acfb82b080c1ffb3

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

40695a2c7c6dec48e6967bf2758794514f68d2e337111e60acfb82b080c1ffb3.exe
Size

382KB
MD5

a33d8c4eb7607c06ddd9947a14bd5ec6
SHA1

8535b0173d277c1990502cbcc507f5d936fb1849
SHA256

40695a2c7c6dec48e6967bf2758794514f68d2e337111e60acfb82b080c1ffb3
SHA512

06d827306e59adad47f11f3f4d61750be93e181b5449eeec7888651a31094be29edd331149e18dbb8beeb67250eda63e2291677ad6eb8729ea89c35e46400fdf
SSDEEP

6144:lK8+cx2nCH9T0tIgWr1q6jCaGzevr2p3Kc9aobf0ClFYzaY/:wpcehWM1dDbf04FSaY/

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	40695a2c7c6dec48e6967bf2758794514f68d2e337111e60acfb82b080c1ffb3.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	40695a2c7c6dec48e6967bf2758794514f68d2e337111e60acfb82b080c1ffb3.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\ExpertCook.job	40695a2c7c6dec48e6967bf2758794514f68d2e337111e60acfb82b080c1ffb3.exe

C:\Users\Admin\AppData\Local\Temp\40695a2c7c6dec48e6967bf2758794514f68d2e337111e60acfb82b080c1ffb3.exe
"C:\Users\Admin\AppData\Local\Temp\40695a2c7c6dec48e6967bf2758794514f68d2e337111e60acfb82b080c1ffb3.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:4924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4924-132-0x00000000009A0000-0x00000000009CF000-memory.dmp

Filesize
188KB

Download
memory/4924-136-0x00000000063F0000-0x0000000006417000-memory.dmp

Filesize
156KB

Download