e437070a0967082ce51e214dd421229c03ee506ef725c6cafe3f237bb0d4b070

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 12:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e6e77f2bec238aa5b5c5cf1dca01722.exe
Size

84KB
MD5

1e6e77f2bec238aa5b5c5cf1dca01722
SHA1

96c63f660911ed9783ca1a799fb491e214e412cb
SHA256

e437070a0967082ce51e214dd421229c03ee506ef725c6cafe3f237bb0d4b070
SHA512

c83306b956bbb5b3fd9e818541e28d540b94a69e45a7924b8766c2bd668f6a04f13a18f3bed1df517255e833dacd8c2dd6e4bd1a0ff489a686d925c56b2fa63c
SSDEEP

1536:9Ivip5SWCRGx00hNpnnF0H6nmHnzUnBtuOy1scTFP8ecjNTw1mBVcL:9IvirSDGxBNpnFa6nQnonruOqsccjN09

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\P:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\B:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\E:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\O:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\S:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\U:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\W:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\Y:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\H:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\N:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\R:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\T:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\V:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\X:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\A:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\G:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\K:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\M:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\Q:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\Z:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\I:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\J:	1e6e77f2bec238aa5b5c5cf1dca01722.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2184	1e6e77f2bec238aa5b5c5cf1dca01722.exe

C:\Users\Admin\AppData\Local\Temp\1e6e77f2bec238aa5b5c5cf1dca01722.exe
"C:\Users\Admin\AppData\Local\Temp\1e6e77f2bec238aa5b5c5cf1dca01722.exe"
1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2184-4-0x00000000041E0000-0x00000000044F2000-memory.dmp

Filesize
3.1MB

Download
memory/2184-5-0x0000000005100000-0x0000000005101000-memory.dmp

Filesize
4KB

Download
memory/2184-2-0x00000000041E0000-0x00000000044F2000-memory.dmp

Filesize
3.1MB

Download