a328b8c63858c6d1c315341b3f49e7c55608487dc03bd7262f8e2e8fac0cdf54

Analysis

max time kernel
190s
max time network
238s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 20:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a328b8c63858c6d1c315341b3f49e7c55608487dc03bd7262f8e2e8fac0cdf54.exe
Size

40KB
MD5

1b05ec7ec6fd56c4022ef44aa4e647f0
SHA1

5374f6c2451e2cef33c20ca869a5602479bcdd42
SHA256

a328b8c63858c6d1c315341b3f49e7c55608487dc03bd7262f8e2e8fac0cdf54
SHA512

99781b4339a3bfafc391bff99429d48837ef8e7f3d1ed789ef54d5305e912d74750bdbe872bec0ed4a46bfa20e09bcb43eaaeb8273cd785bf66cc80a71c66496
SSDEEP

768:Wvq8l1Wn5WoJ4veo5zEnDaI2+Cum3NxSbN7ng+Y/EKdr:WLwn8m4veo5YnDgjusGg

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	a328b8c63858c6d1c315341b3f49e7c55608487dc03bd7262f8e2e8fac0cdf54.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	a328b8c63858c6d1c315341b3f49e7c55608487dc03bd7262f8e2e8fac0cdf54.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 668 set thread context of 316	668	a328b8c63858c6d1c315341b3f49e7c55608487dc03bd7262f8e2e8fac0cdf54.exe	81

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
668	a328b8c63858c6d1c315341b3f49e7c55608487dc03bd7262f8e2e8fac0cdf54.exe
316	a328b8c63858c6d1c315341b3f49e7c55608487dc03bd7262f8e2e8fac0cdf54.exe
316	a328b8c63858c6d1c315341b3f49e7c55608487dc03bd7262f8e2e8fac0cdf54.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 668 wrote to memory of 316	668	a328b8c63858c6d1c315341b3f49e7c55608487dc03bd7262f8e2e8fac0cdf54.exe	81
PID 668 wrote to memory of 316	668	a328b8c63858c6d1c315341b3f49e7c55608487dc03bd7262f8e2e8fac0cdf54.exe	81
PID 668 wrote to memory of 316	668	a328b8c63858c6d1c315341b3f49e7c55608487dc03bd7262f8e2e8fac0cdf54.exe	81
PID 668 wrote to memory of 316	668	a328b8c63858c6d1c315341b3f49e7c55608487dc03bd7262f8e2e8fac0cdf54.exe	81
PID 668 wrote to memory of 316	668	a328b8c63858c6d1c315341b3f49e7c55608487dc03bd7262f8e2e8fac0cdf54.exe	81
PID 668 wrote to memory of 316	668	a328b8c63858c6d1c315341b3f49e7c55608487dc03bd7262f8e2e8fac0cdf54.exe	81
PID 668 wrote to memory of 316	668	a328b8c63858c6d1c315341b3f49e7c55608487dc03bd7262f8e2e8fac0cdf54.exe	81
PID 668 wrote to memory of 316	668	a328b8c63858c6d1c315341b3f49e7c55608487dc03bd7262f8e2e8fac0cdf54.exe	81
PID 668 wrote to memory of 316	668	a328b8c63858c6d1c315341b3f49e7c55608487dc03bd7262f8e2e8fac0cdf54.exe	81

C:\Users\Admin\AppData\Local\Temp\a328b8c63858c6d1c315341b3f49e7c55608487dc03bd7262f8e2e8fac0cdf54.exe
"C:\Users\Admin\AppData\Local\Temp\a328b8c63858c6d1c315341b3f49e7c55608487dc03bd7262f8e2e8fac0cdf54.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:668
- C:\Users\Admin\AppData\Local\Temp\a328b8c63858c6d1c315341b3f49e7c55608487dc03bd7262f8e2e8fac0cdf54.exe
  e|
  2⤵
  - Maps connected drives based on registry
  - Suspicious use of SetWindowsHookEx
  PID:316

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/316-134-0x0000000000000000-mapping.dmp

Download
memory/316-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/316-137-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/316-140-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download