be2a468b5eca4178e1326c7fcf73ef6e6e2eeecd63fdb3d083f564834760ca00

Analysis

max time kernel
187s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 09:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be2a468b5eca4178e1326c7fcf73ef6e6e2eeecd63fdb3d083f564834760ca00.exe
Size

84KB
MD5

e089e4d44c6604e7b66f9e713fa04f1a
SHA1

969b6cd71f598d1c7c27555862f8055ee97dee0e
SHA256

be2a468b5eca4178e1326c7fcf73ef6e6e2eeecd63fdb3d083f564834760ca00
SHA512

c2f28e7539cf664b2c328a88c9a6353e983fb6268a894ba5107e282022c8f7239f65e28057d3fec8456b616aa8cc571969652024e008e7f96ba722240a84077b
SSDEEP

1536:29BMESjjDQjnGOsKpY7/jzT4DFILCEEtL9zypW/3OtaGR1c/:29rSjjkjbY7/j4BILU9m4yRK/

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	be2a468b5eca4178e1326c7fcf73ef6e6e2eeecd63fdb3d083f564834760ca00.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	be2a468b5eca4178e1326c7fcf73ef6e6e2eeecd63fdb3d083f564834760ca00.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3708	be2a468b5eca4178e1326c7fcf73ef6e6e2eeecd63fdb3d083f564834760ca00.exe

C:\Users\Admin\AppData\Local\Temp\be2a468b5eca4178e1326c7fcf73ef6e6e2eeecd63fdb3d083f564834760ca00.exe
"C:\Users\Admin\AppData\Local\Temp\be2a468b5eca4178e1326c7fcf73ef6e6e2eeecd63fdb3d083f564834760ca00.exe"
1⤵
- Maps connected drives based on registry
- Suspicious use of SetWindowsHookEx
PID:3708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...