0b439362a69e51254aa318f50afe8128fc32aad6c9e3495b8a779dd3e3ed5bfd

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
22/07/2023, 16:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Epathobj_Exp64.exe
Size

70KB
MD5

3fed1004befb9834b699a88ccdce757e
SHA1

09195ba4e25ccce35c188657957c0f2c6a61d083
SHA256

0b439362a69e51254aa318f50afe8128fc32aad6c9e3495b8a779dd3e3ed5bfd
SHA512

42ab9f3afaf17893036ba6a0efe4d34cbd4da882f97370c011618888c0d5227d7285d29e6ee90bfd1be1e2e558132561ae75cc17e747e81d96ed8795da8160cf
SSDEEP

1536:XfJDPHTvJl7u5Jr8JsR2Xtl8+xU+RO8UpsWldZC:PJLHTRiJIJk2XtlPgrZC

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CabinetState	Epathobj_Exp64.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CabinetState\Settings = 0c0002000a01000060000000	Epathobj_Exp64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CabinetState\FullPath = "0"	Epathobj_Exp64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	Epathobj_Exp64.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{11DBB47C-A525-400B-9E80-A54615A090C0} {7F9185B0-CB92-43C5-80A9-92277A4F7B54} 0xFFFF = 010000000000000080846722bbbcd901	Epathobj_Exp64.exe

C:\Users\Admin\AppData\Local\Temp\Epathobj_Exp64.exe
"C:\Users\Admin\AppData\Local\Temp\Epathobj_Exp64.exe"
1⤵
- Modifies data under HKEY_USERS
PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2648-53-0x0000000000010000-0x000000000006D000-memory.dmp

Filesize
372KB

Download
memory/2648-54-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2648-55-0x0000000000010000-0x000000000006D000-memory.dmp

Filesize
372KB

Download
memory/2648-56-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download