91130b36fddc9c2d20232aac757906f5bebd6fcd095ca0def8b1c7fa12d21336

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91130b36fddc9c2d20232aac757906f5bebd6fcd095ca0def8b1c7fa12d21336.exe
Size

788KB
MD5

8922155ad4ec73926d6df9b7030c6767
SHA1

c12b2b84ba76b26a085243bdceeb330d8b9e5a3c
SHA256

91130b36fddc9c2d20232aac757906f5bebd6fcd095ca0def8b1c7fa12d21336
SHA512

c0259fb3a58c56b09e91b588d78047eca61beb212ab9333089eeef70e138171117719619dc31a47b7e3c59930f636d98205b76cd2065f0ee824d06402301096b
SSDEEP

12288:rnJcufVmQ/2kGbQ8m3p5c7zkzWiee188qlfjobUqEI7rggjq9K2JKg:TWudikGbuc8zweWlfcbUfI7MgUEg

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

91130b36fddc9c2d20232aac757906f5bebd6fcd095ca0def8b1c7fa12d21336.exe

description	ioc	process
File opened (read-only)	\??\J:	91130b36fddc9c2d20232aac757906f5bebd6fcd095ca0def8b1c7fa12d21336.exe
File opened (read-only)	\??\S:	91130b36fddc9c2d20232aac757906f5bebd6fcd095ca0def8b1c7fa12d21336.exe
File opened (read-only)	\??\Y:	91130b36fddc9c2d20232aac757906f5bebd6fcd095ca0def8b1c7fa12d21336.exe
File opened (read-only)	\??\Z:	91130b36fddc9c2d20232aac757906f5bebd6fcd095ca0def8b1c7fa12d21336.exe
File opened (read-only)	\??\T:	91130b36fddc9c2d20232aac757906f5bebd6fcd095ca0def8b1c7fa12d21336.exe
File opened (read-only)	\??\U:	91130b36fddc9c2d20232aac757906f5bebd6fcd095ca0def8b1c7fa12d21336.exe
File opened (read-only)	\??\G:	91130b36fddc9c2d20232aac757906f5bebd6fcd095ca0def8b1c7fa12d21336.exe
File opened (read-only)	\??\K:	91130b36fddc9c2d20232aac757906f5bebd6fcd095ca0def8b1c7fa12d21336.exe
File opened (read-only)	\??\M:	91130b36fddc9c2d20232aac757906f5bebd6fcd095ca0def8b1c7fa12d21336.exe
File opened (read-only)	\??\N:	91130b36fddc9c2d20232aac757906f5bebd6fcd095ca0def8b1c7fa12d21336.exe
File opened (read-only)	\??\P:	91130b36fddc9c2d20232aac757906f5bebd6fcd095ca0def8b1c7fa12d21336.exe
File opened (read-only)	\??\Q:	91130b36fddc9c2d20232aac757906f5bebd6fcd095ca0def8b1c7fa12d21336.exe
File opened (read-only)	\??\A:	91130b36fddc9c2d20232aac757906f5bebd6fcd095ca0def8b1c7fa12d21336.exe
File opened (read-only)	\??\H:	91130b36fddc9c2d20232aac757906f5bebd6fcd095ca0def8b1c7fa12d21336.exe
File opened (read-only)	\??\I:	91130b36fddc9c2d20232aac757906f5bebd6fcd095ca0def8b1c7fa12d21336.exe
File opened (read-only)	\??\L:	91130b36fddc9c2d20232aac757906f5bebd6fcd095ca0def8b1c7fa12d21336.exe
File opened (read-only)	\??\O:	91130b36fddc9c2d20232aac757906f5bebd6fcd095ca0def8b1c7fa12d21336.exe
File opened (read-only)	\??\X:	91130b36fddc9c2d20232aac757906f5bebd6fcd095ca0def8b1c7fa12d21336.exe
File opened (read-only)	\??\B:	91130b36fddc9c2d20232aac757906f5bebd6fcd095ca0def8b1c7fa12d21336.exe
File opened (read-only)	\??\E:	91130b36fddc9c2d20232aac757906f5bebd6fcd095ca0def8b1c7fa12d21336.exe
File opened (read-only)	\??\F:	91130b36fddc9c2d20232aac757906f5bebd6fcd095ca0def8b1c7fa12d21336.exe
File opened (read-only)	\??\R:	91130b36fddc9c2d20232aac757906f5bebd6fcd095ca0def8b1c7fa12d21336.exe
File opened (read-only)	\??\V:	91130b36fddc9c2d20232aac757906f5bebd6fcd095ca0def8b1c7fa12d21336.exe
File opened (read-only)	\??\W:	91130b36fddc9c2d20232aac757906f5bebd6fcd095ca0def8b1c7fa12d21336.exe

C:\Users\Admin\AppData\Local\Temp\91130b36fddc9c2d20232aac757906f5bebd6fcd095ca0def8b1c7fa12d21336.exe
"C:\Users\Admin\AppData\Local\Temp\91130b36fddc9c2d20232aac757906f5bebd6fcd095ca0def8b1c7fa12d21336.exe"
1⤵
- Enumerates connected drives
PID:4612

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4612-132-0x0000000000400000-0x00000000006C9000-memory.dmp

Filesize
2.8MB

Download
memory/4612-133-0x0000000000400000-0x00000000006C9000-memory.dmp

Filesize
2.8MB

Download
memory/4612-134-0x0000000000400000-0x00000000006C9000-memory.dmp

Filesize
2.8MB

Download
memory/4612-135-0x0000000000400000-0x00000000006C9000-memory.dmp

Filesize
2.8MB

Download
memory/4612-136-0x0000000000400000-0x00000000006C9000-memory.dmp

Filesize
2.8MB

Download
memory/4612-137-0x0000000000400000-0x00000000006C9000-memory.dmp

Filesize
2.8MB

Download