bb74ee0cbb9c9a0118ef45a6013b77c42ea2c34d76cd139afaf041f7e72d445f

Analysis

max time kernel
177s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 21:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bb74ee0cbb9c9a0118ef45a6013b77c42ea2c34d76cd139afaf041f7e72d445f.exe
Size

54KB
MD5

bea11e960b40e7df98d475edc6da9384
SHA1

e780e7c44dd8f19c22c95caeb0ec25ec35d248f1
SHA256

bb74ee0cbb9c9a0118ef45a6013b77c42ea2c34d76cd139afaf041f7e72d445f
SHA512

b0c93008d3bdf391276e68fc46fe0dc0f789c57d8445b41fc55613839daae9fdd95cdec1cde0c75cd164e344276450ab5e76c9af7ef1608033860ac4b834870f
SSDEEP

768:S/05iRcdYFtVM1qUQuvc9HzSHUSUuOOXv8s3i6E5nXfUWPYfIc/Qi3qEBQpf:S88OoVM1q8ewf1OO53i6EBXlLOUp

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WirelessConfig = "c:\\users\\admin\\appdata\\roaming\\svchost10.exe"	bb74ee0cbb9c9a0118ef45a6013b77c42ea2c34d76cd139afaf041f7e72d445f.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	bb74ee0cbb9c9a0118ef45a6013b77c42ea2c34d76cd139afaf041f7e72d445f.exe
File opened (read-only)	\??\Z:	bb74ee0cbb9c9a0118ef45a6013b77c42ea2c34d76cd139afaf041f7e72d445f.exe
File opened (read-only)	\??\E:	bb74ee0cbb9c9a0118ef45a6013b77c42ea2c34d76cd139afaf041f7e72d445f.exe
File opened (read-only)	\??\G:	bb74ee0cbb9c9a0118ef45a6013b77c42ea2c34d76cd139afaf041f7e72d445f.exe
File opened (read-only)	\??\L:	bb74ee0cbb9c9a0118ef45a6013b77c42ea2c34d76cd139afaf041f7e72d445f.exe
File opened (read-only)	\??\M:	bb74ee0cbb9c9a0118ef45a6013b77c42ea2c34d76cd139afaf041f7e72d445f.exe
File opened (read-only)	\??\N:	bb74ee0cbb9c9a0118ef45a6013b77c42ea2c34d76cd139afaf041f7e72d445f.exe
File opened (read-only)	\??\Q:	bb74ee0cbb9c9a0118ef45a6013b77c42ea2c34d76cd139afaf041f7e72d445f.exe
File opened (read-only)	\??\K:	bb74ee0cbb9c9a0118ef45a6013b77c42ea2c34d76cd139afaf041f7e72d445f.exe
File opened (read-only)	\??\O:	bb74ee0cbb9c9a0118ef45a6013b77c42ea2c34d76cd139afaf041f7e72d445f.exe
File opened (read-only)	\??\W:	bb74ee0cbb9c9a0118ef45a6013b77c42ea2c34d76cd139afaf041f7e72d445f.exe
File opened (read-only)	\??\J:	bb74ee0cbb9c9a0118ef45a6013b77c42ea2c34d76cd139afaf041f7e72d445f.exe
File opened (read-only)	\??\R:	bb74ee0cbb9c9a0118ef45a6013b77c42ea2c34d76cd139afaf041f7e72d445f.exe
File opened (read-only)	\??\S:	bb74ee0cbb9c9a0118ef45a6013b77c42ea2c34d76cd139afaf041f7e72d445f.exe
File opened (read-only)	\??\V:	bb74ee0cbb9c9a0118ef45a6013b77c42ea2c34d76cd139afaf041f7e72d445f.exe
File opened (read-only)	\??\Y:	bb74ee0cbb9c9a0118ef45a6013b77c42ea2c34d76cd139afaf041f7e72d445f.exe
File opened (read-only)	\??\F:	bb74ee0cbb9c9a0118ef45a6013b77c42ea2c34d76cd139afaf041f7e72d445f.exe
File opened (read-only)	\??\H:	bb74ee0cbb9c9a0118ef45a6013b77c42ea2c34d76cd139afaf041f7e72d445f.exe
File opened (read-only)	\??\I:	bb74ee0cbb9c9a0118ef45a6013b77c42ea2c34d76cd139afaf041f7e72d445f.exe
File opened (read-only)	\??\P:	bb74ee0cbb9c9a0118ef45a6013b77c42ea2c34d76cd139afaf041f7e72d445f.exe
File opened (read-only)	\??\T:	bb74ee0cbb9c9a0118ef45a6013b77c42ea2c34d76cd139afaf041f7e72d445f.exe
File opened (read-only)	\??\U:	bb74ee0cbb9c9a0118ef45a6013b77c42ea2c34d76cd139afaf041f7e72d445f.exe

C:\Users\Admin\AppData\Local\Temp\bb74ee0cbb9c9a0118ef45a6013b77c42ea2c34d76cd139afaf041f7e72d445f.exe
"C:\Users\Admin\AppData\Local\Temp\bb74ee0cbb9c9a0118ef45a6013b77c42ea2c34d76cd139afaf041f7e72d445f.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
PID:2464

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads