69404d71aa0a674468f2c8abb6ddbd99bffb7c2d0c40cfb252b2c650d8102b98

Analysis

max time kernel
77s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2022 12:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69404d71aa0a674468f2c8abb6ddbd99bffb7c2d0c40cfb252b2c650d8102b98.exe
Size

308KB
MD5

15d477d8b1d8374afc30b18383b501eb
SHA1

ec7990eec518e1a494f0d8e80b378ee98dd81b5e
SHA256

69404d71aa0a674468f2c8abb6ddbd99bffb7c2d0c40cfb252b2c650d8102b98
SHA512

e633d1286128d400986004020f1d6d0a00f39ca32305cf6aa0c221498f8cf3b21ff8cb2f4a8d53b5ff6d70954b4ee71c8d0f91648065b812104a3e79a61bec85
SSDEEP

3072:KRpqLdtd0bI2i6os7iatRx3qQ722tMfktMWaHDt5bn9Sq+qTqC6NJ9J9J1DsU9O:QcvdzyoIRx6frfkJu5bnH+CE9bJ1N9O

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	69404d71aa0a674468f2c8abb6ddbd99bffb7c2d0c40cfb252b2c650d8102b98.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	69404d71aa0a674468f2c8abb6ddbd99bffb7c2d0c40cfb252b2c650d8102b98.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\iPrioritize.job	69404d71aa0a674468f2c8abb6ddbd99bffb7c2d0c40cfb252b2c650d8102b98.exe

C:\Users\Admin\AppData\Local\Temp\69404d71aa0a674468f2c8abb6ddbd99bffb7c2d0c40cfb252b2c650d8102b98.exe
"C:\Users\Admin\AppData\Local\Temp\69404d71aa0a674468f2c8abb6ddbd99bffb7c2d0c40cfb252b2c650d8102b98.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:1992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1992-132-0x00000000001D0000-0x00000000001FF000-memory.dmp

Filesize
188KB

Download
memory/1992-136-0x00000000009B0000-0x00000000009D7000-memory.dmp

Filesize
156KB

Download