Analysis
-
max time kernel
104s -
max time network
108s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 16:49
Static task
static1
Behavioral task
behavioral1
Sample
b3e572c00ed6887c163c858b74f872c9d091448b4cd71488a4b03caf7a702e74.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b3e572c00ed6887c163c858b74f872c9d091448b4cd71488a4b03caf7a702e74.exe
Resource
win10v2004-20221111-en
General
-
Target
b3e572c00ed6887c163c858b74f872c9d091448b4cd71488a4b03caf7a702e74.exe
-
Size
321KB
-
MD5
39f7188acf949214e0aadddd21a1aa21
-
SHA1
701d72c9700427713a9eb3985c0b20275f44868f
-
SHA256
b3e572c00ed6887c163c858b74f872c9d091448b4cd71488a4b03caf7a702e74
-
SHA512
f73dac2178597093996e5520e2881129ff0dfb073015adfee339753cb88a6e8aebde483df931dd13880668fed993311a0504b77f4ca509da1a19adb40a486238
-
SSDEEP
6144:tLEaXPvFzkCX6Qva8Qp3+6r9sdBtQYpr3Sgf:pEafvFztRva8C33r9stF3Sw
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
b3e572c00ed6887c163c858b74f872c9d091448b4cd71488a4b03caf7a702e74.exedescription ioc process Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum b3e572c00ed6887c163c858b74f872c9d091448b4cd71488a4b03caf7a702e74.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum b3e572c00ed6887c163c858b74f872c9d091448b4cd71488a4b03caf7a702e74.exe -
Drops file in Windows directory 1 IoCs
Processes:
b3e572c00ed6887c163c858b74f872c9d091448b4cd71488a4b03caf7a702e74.exedescription ioc process File created C:\Windows\Tasks\KeepMyThings.job b3e572c00ed6887c163c858b74f872c9d091448b4cd71488a4b03caf7a702e74.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1364-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmpFilesize
8KB
-
memory/1364-55-0x0000000000150000-0x000000000017F000-memory.dmpFilesize
188KB
-
memory/1364-59-0x00000000007A0000-0x00000000007C7000-memory.dmpFilesize
156KB
-
memory/1364-63-0x00000000007E1000-0x000000000080B000-memory.dmpFilesize
168KB
-
memory/1364-64-0x00000000007E1000-0x000000000080B000-memory.dmpFilesize
168KB