Analysis
-
max time kernel
180s -
max time network
188s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 16:49
Static task
static1
Behavioral task
behavioral1
Sample
b3e572c00ed6887c163c858b74f872c9d091448b4cd71488a4b03caf7a702e74.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b3e572c00ed6887c163c858b74f872c9d091448b4cd71488a4b03caf7a702e74.exe
Resource
win10v2004-20221111-en
General
-
Target
b3e572c00ed6887c163c858b74f872c9d091448b4cd71488a4b03caf7a702e74.exe
-
Size
321KB
-
MD5
39f7188acf949214e0aadddd21a1aa21
-
SHA1
701d72c9700427713a9eb3985c0b20275f44868f
-
SHA256
b3e572c00ed6887c163c858b74f872c9d091448b4cd71488a4b03caf7a702e74
-
SHA512
f73dac2178597093996e5520e2881129ff0dfb073015adfee339753cb88a6e8aebde483df931dd13880668fed993311a0504b77f4ca509da1a19adb40a486238
-
SSDEEP
6144:tLEaXPvFzkCX6Qva8Qp3+6r9sdBtQYpr3Sgf:pEafvFztRva8C33r9stF3Sw
Malware Config
Signatures
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
b3e572c00ed6887c163c858b74f872c9d091448b4cd71488a4b03caf7a702e74.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum b3e572c00ed6887c163c858b74f872c9d091448b4cd71488a4b03caf7a702e74.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum b3e572c00ed6887c163c858b74f872c9d091448b4cd71488a4b03caf7a702e74.exe -
Drops file in Windows directory 1 IoCs
Processes:
b3e572c00ed6887c163c858b74f872c9d091448b4cd71488a4b03caf7a702e74.exedescription ioc process File created C:\Windows\Tasks\KeepMyThings.job b3e572c00ed6887c163c858b74f872c9d091448b4cd71488a4b03caf7a702e74.exe