991f55206b0f52916a60d0acacaaafcb98d6b5c43b762ebd8d618a207ce8a762

Analysis

max time kernel
140s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 02:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

991f55206b0f52916a60d0acacaaafcb98d6b5c43b762ebd8d618a207ce8a762.exe
Size

60KB
MD5

0dc73a1dd6eef384a03ebc3365c2c680
SHA1

74d02ee8a06700ef1172d7e488ea19f10438f733
SHA256

991f55206b0f52916a60d0acacaaafcb98d6b5c43b762ebd8d618a207ce8a762
SHA512

765c3b43f92737164e00e10ea106aa551ecdd8a02d18ffa8d913d6cc04b6c185c2e9389a938df8ffc6aa69a44f6c71f2eea293173cdf8002b46f0044d7d28c18
SSDEEP

768:XSpv0R7HAdDXe5kYMHkAxKyXfBc5NOjrGeQUFPkl0Iv7zF:X8vZZYdV4Jc2jdxy7zF

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	991f55206b0f52916a60d0acacaaafcb98d6b5c43b762ebd8d618a207ce8a762.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	991f55206b0f52916a60d0acacaaafcb98d6b5c43b762ebd8d618a207ce8a762.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 632 set thread context of 3404	632	991f55206b0f52916a60d0acacaaafcb98d6b5c43b762ebd8d618a207ce8a762.exe	82

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
632	991f55206b0f52916a60d0acacaaafcb98d6b5c43b762ebd8d618a207ce8a762.exe
3404	991f55206b0f52916a60d0acacaaafcb98d6b5c43b762ebd8d618a207ce8a762.exe
3404	991f55206b0f52916a60d0acacaaafcb98d6b5c43b762ebd8d618a207ce8a762.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 3404	632	991f55206b0f52916a60d0acacaaafcb98d6b5c43b762ebd8d618a207ce8a762.exe	82
PID 632 wrote to memory of 3404	632	991f55206b0f52916a60d0acacaaafcb98d6b5c43b762ebd8d618a207ce8a762.exe	82
PID 632 wrote to memory of 3404	632	991f55206b0f52916a60d0acacaaafcb98d6b5c43b762ebd8d618a207ce8a762.exe	82
PID 632 wrote to memory of 3404	632	991f55206b0f52916a60d0acacaaafcb98d6b5c43b762ebd8d618a207ce8a762.exe	82
PID 632 wrote to memory of 3404	632	991f55206b0f52916a60d0acacaaafcb98d6b5c43b762ebd8d618a207ce8a762.exe	82
PID 632 wrote to memory of 3404	632	991f55206b0f52916a60d0acacaaafcb98d6b5c43b762ebd8d618a207ce8a762.exe	82
PID 632 wrote to memory of 3404	632	991f55206b0f52916a60d0acacaaafcb98d6b5c43b762ebd8d618a207ce8a762.exe	82
PID 632 wrote to memory of 3404	632	991f55206b0f52916a60d0acacaaafcb98d6b5c43b762ebd8d618a207ce8a762.exe	82
PID 632 wrote to memory of 3404	632	991f55206b0f52916a60d0acacaaafcb98d6b5c43b762ebd8d618a207ce8a762.exe	82

C:\Users\Admin\AppData\Local\Temp\991f55206b0f52916a60d0acacaaafcb98d6b5c43b762ebd8d618a207ce8a762.exe
"C:\Users\Admin\AppData\Local\Temp\991f55206b0f52916a60d0acacaaafcb98d6b5c43b762ebd8d618a207ce8a762.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:632
- C:\Users\Admin\AppData\Local\Temp\991f55206b0f52916a60d0acacaaafcb98d6b5c43b762ebd8d618a207ce8a762.exe
  a|
  2⤵
  - Maps connected drives based on registry
  - Suspicious use of SetWindowsHookEx
  PID:3404

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3404-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3404-137-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3404-141-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download