97b79a5b12dbac2b4591cbabbdd2db10e1ee7c6e8792bd31855d7cbdbce1cf4d

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 17:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

97b79a5b12dbac2b4591cbabbdd2db10e1ee7c6e8792bd31855d7cbdbce1cf4d.exe
Size

78KB
MD5

11c061d3b572b7fc6605b18f04c7d030
SHA1

cf4210f8d8cf9d111924da03f9455965e8026853
SHA256

97b79a5b12dbac2b4591cbabbdd2db10e1ee7c6e8792bd31855d7cbdbce1cf4d
SHA512

66b645c1aa49fc42295ff55a543d0cd83b8f3772a5bea610654e41297ae440c941d43d56b81381b4650bf1237f379cdf9036f8029d9198c4eb522b303b5011bb
SSDEEP

768:xIuledIxbcMP9a5X8jdgRtP8W3ibep2Jy7txQjf2U+Roq10dCdSM5l:xAdI1ckbdgRbFpzOz2ZRB10dt8

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	97b79a5b12dbac2b4591cbabbdd2db10e1ee7c6e8792bd31855d7cbdbce1cf4d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	97b79a5b12dbac2b4591cbabbdd2db10e1ee7c6e8792bd31855d7cbdbce1cf4d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4972 set thread context of 620	4972	97b79a5b12dbac2b4591cbabbdd2db10e1ee7c6e8792bd31855d7cbdbce1cf4d.exe	80

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4972	97b79a5b12dbac2b4591cbabbdd2db10e1ee7c6e8792bd31855d7cbdbce1cf4d.exe
620	97b79a5b12dbac2b4591cbabbdd2db10e1ee7c6e8792bd31855d7cbdbce1cf4d.exe
620	97b79a5b12dbac2b4591cbabbdd2db10e1ee7c6e8792bd31855d7cbdbce1cf4d.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 620	4972	97b79a5b12dbac2b4591cbabbdd2db10e1ee7c6e8792bd31855d7cbdbce1cf4d.exe	80
PID 4972 wrote to memory of 620	4972	97b79a5b12dbac2b4591cbabbdd2db10e1ee7c6e8792bd31855d7cbdbce1cf4d.exe	80
PID 4972 wrote to memory of 620	4972	97b79a5b12dbac2b4591cbabbdd2db10e1ee7c6e8792bd31855d7cbdbce1cf4d.exe	80
PID 4972 wrote to memory of 620	4972	97b79a5b12dbac2b4591cbabbdd2db10e1ee7c6e8792bd31855d7cbdbce1cf4d.exe	80
PID 4972 wrote to memory of 620	4972	97b79a5b12dbac2b4591cbabbdd2db10e1ee7c6e8792bd31855d7cbdbce1cf4d.exe	80
PID 4972 wrote to memory of 620	4972	97b79a5b12dbac2b4591cbabbdd2db10e1ee7c6e8792bd31855d7cbdbce1cf4d.exe	80
PID 4972 wrote to memory of 620	4972	97b79a5b12dbac2b4591cbabbdd2db10e1ee7c6e8792bd31855d7cbdbce1cf4d.exe	80
PID 4972 wrote to memory of 620	4972	97b79a5b12dbac2b4591cbabbdd2db10e1ee7c6e8792bd31855d7cbdbce1cf4d.exe	80
PID 4972 wrote to memory of 620	4972	97b79a5b12dbac2b4591cbabbdd2db10e1ee7c6e8792bd31855d7cbdbce1cf4d.exe	80

C:\Users\Admin\AppData\Local\Temp\97b79a5b12dbac2b4591cbabbdd2db10e1ee7c6e8792bd31855d7cbdbce1cf4d.exe
"C:\Users\Admin\AppData\Local\Temp\97b79a5b12dbac2b4591cbabbdd2db10e1ee7c6e8792bd31855d7cbdbce1cf4d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Users\Admin\AppData\Local\Temp\97b79a5b12dbac2b4591cbabbdd2db10e1ee7c6e8792bd31855d7cbdbce1cf4d.exe
  a|
  2⤵
  - Maps connected drives based on registry
  - Suspicious use of SetWindowsHookEx
  PID:620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/620-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/620-137-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/620-141-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download