9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 14:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe
Size

549KB
MD5

299f72f43835e7354683fb37e8c3cbe2
SHA1

6cb67b0ab81fbe5da6913ceb5e34067d8836c22b
SHA256

9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee
SHA512

813717c80575c4ade713481a290fce863ab81a0d8ba9af1ac1c846ecff267704ae72b2ebc1de6825226a630d6f8e00c1f1f3fcbbb17290673bfcc7bb717ed10c
SSDEEP

12288:RJBZ+mhKYgGpThpmGVF6VpnExhwr5GwLPYq8bm+4Esk0:RNhKYlR/VMVFChwr5jGy+/sk0

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2564 set thread context of 3352	2564	9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe	81

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2564	9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 3352	2564	9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe	81
PID 2564 wrote to memory of 3352	2564	9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe	81
PID 2564 wrote to memory of 3352	2564	9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe	81
PID 2564 wrote to memory of 3352	2564	9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe	81
PID 2564 wrote to memory of 3352	2564	9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe	81
PID 2564 wrote to memory of 3352	2564	9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe	81
PID 2564 wrote to memory of 3352	2564	9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe	81
PID 2564 wrote to memory of 3352	2564	9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe	81
PID 2564 wrote to memory of 3352	2564	9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe	81

C:\Users\Admin\AppData\Local\Temp\9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe
"C:\Users\Admin\AppData\Local\Temp\9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe"
1⤵
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Users\Admin\AppData\Local\Temp\9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe
  C:\Users\Admin\AppData\Local\Temp\9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe
  2⤵
  PID:3352

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3352-135-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3352-137-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3352-138-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download