a31e8c02b958ce92a72331455bffb74b15f9b4ae77c3b7f2768f9165c6de43d1

Analysis

max time kernel
95s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
31/10/2022, 22:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

歌曲搜索程序1/歌曲搜索.exe
Size

41KB
MD5

ad31e8465c637cb7ed8b09704fd4aa18
SHA1

0c7fbb4d09cba433556069cf0b2c749a77e14775
SHA256

56c7ed865ddeaa37ce5efef504def72cd752451133c7aff9fa89d924cce4b087
SHA512

553256ce5120cbef3725bf30518af75903f3a215d046c330be25f1efc723a29f67f300b9c99bbf80bc88e9e6ca1966adc176d2fabf690b8d063f1603121cc3f7
SSDEEP

768:KkVP/j5PCroBK5lkj5z8Gr2S/K9KpIJpyDh/k4pgZWm+:ptPCrog7kdzViS/K9KpICDtk8g

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	歌曲搜索.exe
File opened (read-only)	\??\Z:	歌曲搜索.exe
File opened (read-only)	\??\B:	歌曲搜索.exe
File opened (read-only)	\??\E:	歌曲搜索.exe
File opened (read-only)	\??\F:	歌曲搜索.exe
File opened (read-only)	\??\J:	歌曲搜索.exe
File opened (read-only)	\??\M:	歌曲搜索.exe
File opened (read-only)	\??\S:	歌曲搜索.exe
File opened (read-only)	\??\O:	歌曲搜索.exe
File opened (read-only)	\??\P:	歌曲搜索.exe
File opened (read-only)	\??\R:	歌曲搜索.exe
File opened (read-only)	\??\W:	歌曲搜索.exe
File opened (read-only)	\??\Y:	歌曲搜索.exe
File opened (read-only)	\??\G:	歌曲搜索.exe
File opened (read-only)	\??\I:	歌曲搜索.exe
File opened (read-only)	\??\U:	歌曲搜索.exe
File opened (read-only)	\??\V:	歌曲搜索.exe
File opened (read-only)	\??\T:	歌曲搜索.exe
File opened (read-only)	\??\A:	歌曲搜索.exe
File opened (read-only)	\??\H:	歌曲搜索.exe
File opened (read-only)	\??\K:	歌曲搜索.exe
File opened (read-only)	\??\L:	歌曲搜索.exe
File opened (read-only)	\??\N:	歌曲搜索.exe
File opened (read-only)	\??\Q:	歌曲搜索.exe

C:\Users\Admin\AppData\Local\Temp\歌曲搜索程序1\歌曲搜索.exe
"C:\Users\Admin\AppData\Local\Temp\歌曲搜索程序1\歌曲搜索.exe"
1⤵
- Enumerates connected drives
PID:1672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-54-0x0000000000F20000-0x0000000000F30000-memory.dmp

Filesize
64KB

Download
memory/1672-55-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download
memory/1672-56-0x0000000000670000-0x0000000000684000-memory.dmp

Filesize
80KB

Download
memory/1672-57-0x0000000000C90000-0x0000000000CE8000-memory.dmp

Filesize
352KB

Download
memory/1672-58-0x0000000000C55000-0x0000000000C66000-memory.dmp

Filesize
68KB

Download
memory/1672-59-0x0000000000C55000-0x0000000000C66000-memory.dmp

Filesize
68KB

Download