1d7670f0b30b9815a2c6531a46c95ca737bccad74a739879b1a172421bdca4dc

Analysis

max time kernel
143s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 08:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11ee6959f44b8ac00723a94ce86233ae.exe
Size

322KB
MD5

11ee6959f44b8ac00723a94ce86233ae
SHA1

f587c875342583977076b20d8ffc6b30204df397
SHA256

1d7670f0b30b9815a2c6531a46c95ca737bccad74a739879b1a172421bdca4dc
SHA512

3db9072305ab3f25c9a6398fe5e26d2ac991f9db0794c46bd341af51ae2507fe1949aa76a02c78d5b1fdd8e1554198bcb6bdcc81b924171b009a0e44a3905bb9
SSDEEP

6144:IXPn2EJLWvidxTtopGgKhQjrFb+msxuRRx56:A+ENWvidxTtlgKh4BsxuRRz6

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	11ee6959f44b8ac00723a94ce86233ae.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	11ee6959f44b8ac00723a94ce86233ae.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\EasyTrain.job	11ee6959f44b8ac00723a94ce86233ae.exe

C:\Users\Admin\AppData\Local\Temp\11ee6959f44b8ac00723a94ce86233ae.exe
"C:\Users\Admin\AppData\Local\Temp\11ee6959f44b8ac00723a94ce86233ae.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:3744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3744-0-0x0000000000AB0000-0x0000000000BB0000-memory.dmp

Filesize
1024KB

Download
memory/3744-2-0x0000000004080000-0x00000000040AF000-memory.dmp

Filesize
188KB

Download
memory/3744-9-0x0000000004CE0000-0x0000000004D07000-memory.dmp

Filesize
156KB

Download