dece129b718f3ca13cc70993f705740d824497397291b5a0e063ecf1924bc214

Analysis

max time kernel
42s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 05:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dece129b718f3ca13cc70993f705740d824497397291b5a0e063ecf1924bc214.exe
Size

243KB
MD5

0e29b2d875e9a694d0009017575ad2a0
SHA1

10129e1ed06b5e3308827c35d50c985d87bc1e61
SHA256

dece129b718f3ca13cc70993f705740d824497397291b5a0e063ecf1924bc214
SHA512

bb4c5291d5ae3ce7b1cfceddf6561eb5ef1d455c6923d978b84d593a7ea96c83a49b97b76faf4c449de9890138fd995961363fe935bd593dee28165201173562
SSDEEP

6144:j4E+59/Vek5vDEKPvA1BcDhwDxrPPP1Tp:3+5VVW/ww9Lxp

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	dece129b718f3ca13cc70993f705740d824497397291b5a0e063ecf1924bc214.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	dece129b718f3ca13cc70993f705740d824497397291b5a0e063ecf1924bc214.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Bidaily Synchronize Task[973b].job	dece129b718f3ca13cc70993f705740d824497397291b5a0e063ecf1924bc214.exe

C:\Users\Admin\AppData\Local\Temp\dece129b718f3ca13cc70993f705740d824497397291b5a0e063ecf1924bc214.exe
"C:\Users\Admin\AppData\Local\Temp\dece129b718f3ca13cc70993f705740d824497397291b5a0e063ecf1924bc214.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/732-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/732-55-0x00000000001C0000-0x00000000001EF000-memory.dmp

Filesize
188KB

Download
memory/732-59-0x00000000001F0000-0x0000000000217000-memory.dmp

Filesize
156KB

Download
memory/732-63-0x00000000000F0000-0x0000000000119000-memory.dmp

Filesize
164KB

Download