afb791113913132a860fdca9d23da6f3c2469d2dfb90dece40d49060f7121452

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 08:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

afb791113913132a860fdca9d23da6f3c2469d2dfb90dece40d49060f7121452.exe
Size

383KB
MD5

3e5f9743ca154422b729e89e7ae66962
SHA1

2cb3e2567eb095f55ccb30d31f8641b3c8779312
SHA256

afb791113913132a860fdca9d23da6f3c2469d2dfb90dece40d49060f7121452
SHA512

c30b51285d18d908d9e5f9a8da36fd38b9a4e5e61e57aeadb968afcb71396804e77786653774955661607c72cd2e286512dd97f8655f7a262367a4d11a7baea3
SSDEEP

6144:wF54L3asXHBZarH0/xFLCaq5Qq1ZUztqwPMwI9CD5iGl18ZwheMYW495N:wP4LMwxIaq5bZUzEwPMpEZH8Zfdp95N

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	afb791113913132a860fdca9d23da6f3c2469d2dfb90dece40d49060f7121452.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	afb791113913132a860fdca9d23da6f3c2469d2dfb90dece40d49060f7121452.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\FoodPairings.job	afb791113913132a860fdca9d23da6f3c2469d2dfb90dece40d49060f7121452.exe

C:\Users\Admin\AppData\Local\Temp\afb791113913132a860fdca9d23da6f3c2469d2dfb90dece40d49060f7121452.exe
"C:\Users\Admin\AppData\Local\Temp\afb791113913132a860fdca9d23da6f3c2469d2dfb90dece40d49060f7121452.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:4804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4804-132-0x0000000001A60000-0x0000000001A8F000-memory.dmp

Filesize
188KB

Download
memory/4804-136-0x0000000001AD0000-0x0000000001AF7000-memory.dmp

Filesize
156KB

Download