ef7cdd9b4073eb70e3d9e64c3f05c5e07d044c5e19138974d9a54cb70b95fc56

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2022, 00:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef7cdd9b4073eb70e3d9e64c3f05c5e07d044c5e19138974d9a54cb70b95fc56.exe
Size

344KB
MD5

a1194e3bd16acdf60795d87c4cc067fd
SHA1

a5351a8a7835f649bcd5b6e36a536fbb80ba3b3b
SHA256

ef7cdd9b4073eb70e3d9e64c3f05c5e07d044c5e19138974d9a54cb70b95fc56
SHA512

888a7c7cb3492c4ad24dae1e053f1ba0cbc727e670199d487b90c94931307aabc39909123b83d6c6cffe9e41f8e2842fdb10165d684bbfe2513de0b1e5d81e68
SSDEEP

6144:/adj3WutZ/7XHTy8DFaNXaZXjLjuedLFDn9gOzimVJXqRtA6zF6i9i:ij3sCadaZXnju+JD5zXa46gyi

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	ef7cdd9b4073eb70e3d9e64c3f05c5e07d044c5e19138974d9a54cb70b95fc56.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	ef7cdd9b4073eb70e3d9e64c3f05c5e07d044c5e19138974d9a54cb70b95fc56.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\WalkingBuddy.job	ef7cdd9b4073eb70e3d9e64c3f05c5e07d044c5e19138974d9a54cb70b95fc56.exe

C:\Users\Admin\AppData\Local\Temp\ef7cdd9b4073eb70e3d9e64c3f05c5e07d044c5e19138974d9a54cb70b95fc56.exe
"C:\Users\Admin\AppData\Local\Temp\ef7cdd9b4073eb70e3d9e64c3f05c5e07d044c5e19138974d9a54cb70b95fc56.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:2764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2764-132-0x0000000000840000-0x000000000087B000-memory.dmp

Filesize
236KB

Download
memory/2764-133-0x0000000000960000-0x000000000098F000-memory.dmp

Filesize
188KB

Download
memory/2764-137-0x00000000009F0000-0x0000000000A17000-memory.dmp

Filesize
156KB

Download
memory/2764-141-0x0000000000840000-0x000000000087B000-memory.dmp

Filesize
236KB

Download