7f2f2172be6c90e87c37a84f7cf3ea44f8e1d543fe69e8fdfb6349fab5ee6e42

Analysis

max time kernel
35s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 06:04

Target

7f2f2172be6c90e87c37a84f7cf3ea44f8e1d543fe69e8fdfb6349fab5ee6e42.exe
Size

157KB
MD5

458537a045a10e5c4babac225d10322e
SHA1

3e3b6b1f0f4a6dfa1e5edda949b295414d30a0a3
SHA256

7f2f2172be6c90e87c37a84f7cf3ea44f8e1d543fe69e8fdfb6349fab5ee6e42
SHA512

0464f24a4333d6496f550f96a42b980758f7bb9f5fab20651bef8fe3bdf498b3f309ce6c84a617967c4150242f9106d62745c04c2af2b73c4bff7b774992c710
SSDEEP

3072:r8lIPZKuXSCiZ5NhUfp9bRNQjrVURFTVZn3QGsfk7oinAowssD1Lgx4aLkv6wfui:r8+3X4KR9NqjpU/33WkkGdsxgSf/

Score

6^/10

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	7f2f2172be6c90e87c37a84f7cf3ea44f8e1d543fe69e8fdfb6349fab5ee6e42.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	7f2f2172be6c90e87c37a84f7cf3ea44f8e1d543fe69e8fdfb6349fab5ee6e42.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
368	7f2f2172be6c90e87c37a84f7cf3ea44f8e1d543fe69e8fdfb6349fab5ee6e42.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/368-54-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download
memory/368-55-0x0000000000220000-0x0000000000240000-memory.dmp

Filesize
128KB

Download
memory/368-56-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download