f47e3555461472f23ab4766e4d5b6f6fd260e335a6abc31b860e569a720a5446

Resubmissions

29/11/2022, 11:04

221129-m6rknaff5s 6

29/11/2022, 10:57

221129-m2m2nscc68 1

Analysis

max time kernel
180s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 11:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NetworkShare_pre2.exe
Size

125KB
MD5

597de376b1f80c06d501415dd973dcec
SHA1

629c9649ced38fd815124221b80c9d9c59a85e74
SHA256

f47e3555461472f23ab4766e4d5b6f6fd260e335a6abc31b860e569a720a5446
SHA512

072565912208e97cc691e1a102e32fd6c243b5a3f8047a159e97aabbe302bddc36f3c52cecde3b506151bc89e0f3b5acf6552a82d83dac6e0180c873d36d3f6b
SSDEEP

1536:Vc4Kvp6PWy/6oU2cpzLWJst+cYsu0TXSkdlgNPldqxFktvVg49jvvck1y40sWjcu:Vc3GJQ56et+cT7SoeNdqbMfN7TId

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	NetworkShare_pre2.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 4616	1896	NetworkShare_pre2.exe	84
PID 1896 wrote to memory of 4616	1896	NetworkShare_pre2.exe	84
PID 1896 wrote to memory of 4616	1896	NetworkShare_pre2.exe	84

C:\Users\Admin\AppData\Local\Temp\NetworkShare_pre2.exe
"C:\Users\Admin\AppData\Local\Temp\NetworkShare_pre2.exe"
1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4616

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads