828e97849947eac4a9ca96aade810bc90564831d648a6b16c0c7902e465e6b74

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 06:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ICONCH~1.exe
Size

1.1MB
MD5

714fec58517cf8ec758106f9e92cb4cd
SHA1

b1b03ba2dd2f94ce07b055854687fe5853324309
SHA256

a4ec43ad30c758d0a1737edcedd29934a442e0dc8b5ff95cb593b150becfad82
SHA512

7eba6963e166e92992208587e11f20992f6166101708dee47282e405a393002266e098f6e7d2aade9c5edd6887c8192bf4eac3f5f797134beef334c81f459c3a
SSDEEP

24576:2mQcUXo8ZwC+trY/dESAMtsYW3z6Hgc5OD+3zF3yiRFUh93AFI/eKwUoWHw:xw7vQrYVftPDOD8zg8Fw3iI/eRWQ

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ICONCH~1.exe

description	ioc	process
File opened (read-only)	\??\B:	ICONCH~1.exe
File opened (read-only)	\??\E:	ICONCH~1.exe
File opened (read-only)	\??\H:	ICONCH~1.exe
File opened (read-only)	\??\L:	ICONCH~1.exe
File opened (read-only)	\??\A:	ICONCH~1.exe
File opened (read-only)	\??\P:	ICONCH~1.exe
File opened (read-only)	\??\R:	ICONCH~1.exe
File opened (read-only)	\??\W:	ICONCH~1.exe
File opened (read-only)	\??\X:	ICONCH~1.exe
File opened (read-only)	\??\N:	ICONCH~1.exe
File opened (read-only)	\??\G:	ICONCH~1.exe
File opened (read-only)	\??\I:	ICONCH~1.exe
File opened (read-only)	\??\J:	ICONCH~1.exe
File opened (read-only)	\??\O:	ICONCH~1.exe
File opened (read-only)	\??\Q:	ICONCH~1.exe
File opened (read-only)	\??\T:	ICONCH~1.exe
File opened (read-only)	\??\U:	ICONCH~1.exe
File opened (read-only)	\??\F:	ICONCH~1.exe
File opened (read-only)	\??\Z:	ICONCH~1.exe
File opened (read-only)	\??\Y:	ICONCH~1.exe
File opened (read-only)	\??\M:	ICONCH~1.exe
File opened (read-only)	\??\S:	ICONCH~1.exe
File opened (read-only)	\??\V:	ICONCH~1.exe
File opened (read-only)	\??\K:	ICONCH~1.exe

C:\Users\Admin\AppData\Local\Temp\ICONCH~1.exe
"C:\Users\Admin\AppData\Local\Temp\ICONCH~1.exe"
1⤵
- Enumerates connected drives
PID:3464

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads