47e354afbc26ed817e3bf7c516cb47e091648001cfc209a2d1f347d515d98052

Analysis

max time kernel
171s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 12:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47e354afbc26ed817e3bf7c516cb47e091648001cfc209a2d1f347d515d98052.exe
Size

343KB
MD5

106fc2c833dbe6b6ceaa78a012215e4a
SHA1

6cb5c4164f5761e7d0ddb3297e625141c3a91895
SHA256

47e354afbc26ed817e3bf7c516cb47e091648001cfc209a2d1f347d515d98052
SHA512

151609c58b6227475a92dcb076fa160e6900928fe3c8e3d38971a8f2bb8dfb1011c11c0076f56c0e655d53037b7c9017ed64beaba0cc6a810341768a93830e31
SSDEEP

6144:67vJRFbFHskaSgF7PQP7oqQtLoEw1QuNJ0zLkigCI76xJG5usxQ/htvYpX7TpJWu:KvJRFxW6ToqQts3Qun03EC2oGUs65tE3

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	47e354afbc26ed817e3bf7c516cb47e091648001cfc209a2d1f347d515d98052.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	47e354afbc26ed817e3bf7c516cb47e091648001cfc209a2d1f347d515d98052.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\PocketScanner.job	47e354afbc26ed817e3bf7c516cb47e091648001cfc209a2d1f347d515d98052.exe

C:\Users\Admin\AppData\Local\Temp\47e354afbc26ed817e3bf7c516cb47e091648001cfc209a2d1f347d515d98052.exe
"C:\Users\Admin\AppData\Local\Temp\47e354afbc26ed817e3bf7c516cb47e091648001cfc209a2d1f347d515d98052.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:4912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4912-132-0x0000000000100000-0x000000000013B000-memory.dmp

Filesize
236KB

Download
memory/4912-133-0x0000000000970000-0x000000000099F000-memory.dmp

Filesize
188KB

Download
memory/4912-137-0x0000000006840000-0x0000000006867000-memory.dmp

Filesize
156KB

Download
memory/4912-141-0x0000000000100000-0x000000000013B000-memory.dmp

Filesize
236KB

Download