2144af13c89df795a931f33782497571fe0d3d03918413443d6cebf992af03bd

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 14:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

022e9b48b3360b0a002368b25a9485af.exe
Size

257KB
MD5

022e9b48b3360b0a002368b25a9485af
SHA1

65e3bdd1aa8d73e36166815052bd798420ce809d
SHA256

2144af13c89df795a931f33782497571fe0d3d03918413443d6cebf992af03bd
SHA512

3ed6d7527c6a0cf215d47fdf5545060649d028f8004f1caa47911e04f57592e857e3abf2eb137b9c9afe32e01c789d8c2e0c96eb9aaabe405b35c5a2e1d01231
SSDEEP

6144:oPk084etyiJK6ayhTz+Czsh9TpLP5vTzE:of8PR0y+CG9TpLBvTzE

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	022e9b48b3360b0a002368b25a9485af.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	022e9b48b3360b0a002368b25a9485af.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\SmoothInterface.job	022e9b48b3360b0a002368b25a9485af.exe

C:\Users\Admin\AppData\Local\Temp\022e9b48b3360b0a002368b25a9485af.exe
"C:\Users\Admin\AppData\Local\Temp\022e9b48b3360b0a002368b25a9485af.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:4360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4360-3-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/4360-2-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/4360-9-0x0000000000410000-0x0000000000439000-memory.dmp

Filesize
164KB

Download
memory/4360-18-0x0000000000410000-0x0000000000439000-memory.dmp

Filesize
164KB

Download
memory/4360-16-0x0000000000410000-0x0000000000439000-memory.dmp

Filesize
164KB

Download
memory/4360-12-0x00000000005C0000-0x00000000005E7000-memory.dmp

Filesize
156KB

Download
memory/4360-5-0x0000000000540000-0x000000000056F000-memory.dmp

Filesize
188KB

Download
memory/4360-4-0x0000000000410000-0x0000000000439000-memory.dmp

Filesize
164KB

Download
memory/4360-25-0x0000000000410000-0x0000000000439000-memory.dmp

Filesize
164KB

Download
memory/4360-1-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/4360-0-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download