8fc73079bee093a1e553bd3cf0fca91cb0f1b3728d9b17d7e13ba1f3a077ec54

Analysis

max time kernel
147s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
23/09/2023, 19:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8fc73079bee093a1e553bd3cf0fca91cb0f1b3728d9b17d7e13ba1f3a077ec54.exe
Size

1.9MB
MD5

b54227808d54be70d923e35e3a982a2c
SHA1

43268d52fe78db7742efc4e3ba9f2525a27d62ca
SHA256

8fc73079bee093a1e553bd3cf0fca91cb0f1b3728d9b17d7e13ba1f3a077ec54
SHA512

3cd196eee1ffd51bd4591061f96d36a49957fe0d8702f365dcb4ba4d386a119ef952bd1d8d41d61a2473ad09c99ac11c7f9e416090479299f202e1ae52a4ad55
SSDEEP

24576:nnydrlmN3hlnuhlR3N/eWdw8Yhd3XWJtKFMUaNUz4jQy7dF2+o3:+lmNznqlVMWK8UVXQtWEQe32+k

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	8fc73079bee093a1e553bd3cf0fca91cb0f1b3728d9b17d7e13ba1f3a077ec54.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count	8fc73079bee093a1e553bd3cf0fca91cb0f1b3728d9b17d7e13ba1f3a077ec54.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	8fc73079bee093a1e553bd3cf0fca91cb0f1b3728d9b17d7e13ba1f3a077ec54.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4012	8fc73079bee093a1e553bd3cf0fca91cb0f1b3728d9b17d7e13ba1f3a077ec54.exe

C:\Users\Admin\AppData\Local\Temp\8fc73079bee093a1e553bd3cf0fca91cb0f1b3728d9b17d7e13ba1f3a077ec54.exe
"C:\Users\Admin\AppData\Local\Temp\8fc73079bee093a1e553bd3cf0fca91cb0f1b3728d9b17d7e13ba1f3a077ec54.exe"
1⤵
- Maps connected drives based on registry
- Suspicious behavior: GetForegroundWindowSpam
PID:4012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...