cbd7419212cbad1e38aedbc137fd1dccca7ed2512db5b2b48dbf6e3de391ab2c

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 23:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbd7419212cbad1e38aedbc137fd1dccca7ed2512db5b2b48dbf6e3de391ab2c.exe
Size

198KB
MD5

611d61b3e804ad48ad9f00fa83de9733
SHA1

9689676fe6a252df647b43541144c18de821885e
SHA256

cbd7419212cbad1e38aedbc137fd1dccca7ed2512db5b2b48dbf6e3de391ab2c
SHA512

75712929a7e2f47e6ad41901c9077756d29a9673b60cb43653c456fe661231eecf6b4a60a34906ec23d51f5f17cab7442fc9b80804c4f4d2f47a686df2277b57
SSDEEP

6144:LL6AwB/ECJ2/F469hmve/0HsILU/SIWnxHhoSYs:LL6qC6F469hz/0H7LU/SzHhoS3

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	cbd7419212cbad1e38aedbc137fd1dccca7ed2512db5b2b48dbf6e3de391ab2c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	cbd7419212cbad1e38aedbc137fd1dccca7ed2512db5b2b48dbf6e3de391ab2c.exe

C:\Users\Admin\AppData\Local\Temp\cbd7419212cbad1e38aedbc137fd1dccca7ed2512db5b2b48dbf6e3de391ab2c.exe
"C:\Users\Admin\AppData\Local\Temp\cbd7419212cbad1e38aedbc137fd1dccca7ed2512db5b2b48dbf6e3de391ab2c.exe"
1⤵
- Maps connected drives based on registry
PID:1000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1000-54-0x0000000076561000-0x0000000076563000-memory.dmp

Filesize
8KB

Download
memory/1000-55-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1000-56-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1000-57-0x00000000001C0000-0x00000000001D5000-memory.dmp

Filesize
84KB

Download