Analysis
-
max time kernel
149s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 19:31
Static task
static1
Behavioral task
behavioral1
Sample
e06cda2e91560805aefb6fea46485cc5b732c73884df168ab8ce5eb9026dbac5.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e06cda2e91560805aefb6fea46485cc5b732c73884df168ab8ce5eb9026dbac5.exe
Resource
win10v2004-20221111-en
General
-
Target
e06cda2e91560805aefb6fea46485cc5b732c73884df168ab8ce5eb9026dbac5.exe
-
Size
64KB
-
MD5
6660b420f4d686ef92fdcbea4eb01ba3
-
SHA1
811541b72ef2667b3ab22dafedca020f3f94b6b6
-
SHA256
e06cda2e91560805aefb6fea46485cc5b732c73884df168ab8ce5eb9026dbac5
-
SHA512
258411c1e45610490a657ac1de28945e5297eedd4809336ccc4e042e69145486940b6debdc34837509786e224c364fb60cb4b8921115837e3bd997ccce5eeff5
-
SSDEEP
1536:/sdlVVLac08TBTwLruG79a/OBpGWMWzS8AKhnK:/svVVLLdpQrBC4QjWzS8AKhnK
Malware Config
Signatures
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
e06cda2e91560805aefb6fea46485cc5b732c73884df168ab8ce5eb9026dbac5.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum e06cda2e91560805aefb6fea46485cc5b732c73884df168ab8ce5eb9026dbac5.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 e06cda2e91560805aefb6fea46485cc5b732c73884df168ab8ce5eb9026dbac5.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
e06cda2e91560805aefb6fea46485cc5b732c73884df168ab8ce5eb9026dbac5.exepid process 2444 e06cda2e91560805aefb6fea46485cc5b732c73884df168ab8ce5eb9026dbac5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e06cda2e91560805aefb6fea46485cc5b732c73884df168ab8ce5eb9026dbac5.exe"C:\Users\Admin\AppData\Local\Temp\e06cda2e91560805aefb6fea46485cc5b732c73884df168ab8ce5eb9026dbac5.exe"1⤵
- Maps connected drives based on registry
- Suspicious use of SetWindowsHookEx
PID:2444