e7d0f3066cbe5a3f78c117540d86fa85c4027bf45bd04a3778f13494d9a80d65

Analysis

max time kernel
119s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2704b97774e0257c01e936bd0e70e15c.exe
Size

1.0MB
MD5

2704b97774e0257c01e936bd0e70e15c
SHA1

8e758b6f8213edc4e4a11600e7af19e5735a9063
SHA256

e7d0f3066cbe5a3f78c117540d86fa85c4027bf45bd04a3778f13494d9a80d65
SHA512

a4240e451662a9bee209f534efb43a43ff327351d5ea1c26c87e1d5e5bc642bed0983de6d4aed42e7f0899004ff958dd37ba7877bfc246660b6341c4e18cc6ca
SSDEEP

24576:DPFBgOHXKKn9uUVz1Olrg+pibjaiVVbKv5Nnv30C:7FCO3L9u+OlFiXah

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	2704b97774e0257c01e936bd0e70e15c.exe
File opened (read-only)	\??\Q:	2704b97774e0257c01e936bd0e70e15c.exe
File opened (read-only)	\??\W:	2704b97774e0257c01e936bd0e70e15c.exe
File opened (read-only)	\??\Z:	2704b97774e0257c01e936bd0e70e15c.exe
File opened (read-only)	\??\H:	2704b97774e0257c01e936bd0e70e15c.exe
File opened (read-only)	\??\R:	2704b97774e0257c01e936bd0e70e15c.exe
File opened (read-only)	\??\S:	2704b97774e0257c01e936bd0e70e15c.exe
File opened (read-only)	\??\U:	2704b97774e0257c01e936bd0e70e15c.exe
File opened (read-only)	\??\V:	2704b97774e0257c01e936bd0e70e15c.exe
File opened (read-only)	\??\B:	2704b97774e0257c01e936bd0e70e15c.exe
File opened (read-only)	\??\I:	2704b97774e0257c01e936bd0e70e15c.exe
File opened (read-only)	\??\K:	2704b97774e0257c01e936bd0e70e15c.exe
File opened (read-only)	\??\P:	2704b97774e0257c01e936bd0e70e15c.exe
File opened (read-only)	\??\T:	2704b97774e0257c01e936bd0e70e15c.exe
File opened (read-only)	\??\Y:	2704b97774e0257c01e936bd0e70e15c.exe
File opened (read-only)	\??\O:	2704b97774e0257c01e936bd0e70e15c.exe
File opened (read-only)	\??\X:	2704b97774e0257c01e936bd0e70e15c.exe
File opened (read-only)	\??\A:	2704b97774e0257c01e936bd0e70e15c.exe
File opened (read-only)	\??\E:	2704b97774e0257c01e936bd0e70e15c.exe
File opened (read-only)	\??\J:	2704b97774e0257c01e936bd0e70e15c.exe
File opened (read-only)	\??\L:	2704b97774e0257c01e936bd0e70e15c.exe
File opened (read-only)	\??\M:	2704b97774e0257c01e936bd0e70e15c.exe
File opened (read-only)	\??\N:	2704b97774e0257c01e936bd0e70e15c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3716	2704b97774e0257c01e936bd0e70e15c.exe
3716	2704b97774e0257c01e936bd0e70e15c.exe

C:\Users\Admin\AppData\Local\Temp\2704b97774e0257c01e936bd0e70e15c.exe
"C:\Users\Admin\AppData\Local\Temp\2704b97774e0257c01e936bd0e70e15c.exe"
1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:3716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3716-0-0x0000000000400000-0x000000000065A000-memory.dmp

Filesize
2.4MB

Download
memory/3716-1-0x00000000023A0000-0x00000000023A2000-memory.dmp

Filesize
8KB

Download
memory/3716-2-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/3716-4-0x0000000000400000-0x000000000065A000-memory.dmp

Filesize
2.4MB

Download
memory/3716-5-0x0000000000400000-0x000000000065A000-memory.dmp

Filesize
2.4MB

Download
memory/3716-6-0x00000000023A0000-0x00000000023A2000-memory.dmp

Filesize
8KB

Download
memory/3716-7-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/3716-8-0x0000000000400000-0x000000000065A000-memory.dmp

Filesize
2.4MB

Download
memory/3716-9-0x0000000000400000-0x000000000065A000-memory.dmp

Filesize
2.4MB

Download
memory/3716-10-0x0000000000400000-0x000000000065A000-memory.dmp

Filesize
2.4MB

Download
memory/3716-13-0x0000000000400000-0x000000000065A000-memory.dmp

Filesize
2.4MB

Download
memory/3716-14-0x0000000000400000-0x000000000065A000-memory.dmp

Filesize
2.4MB

Download
memory/3716-15-0x0000000000400000-0x000000000065A000-memory.dmp

Filesize
2.4MB

Download
memory/3716-16-0x0000000000400000-0x000000000065A000-memory.dmp

Filesize
2.4MB

Download
memory/3716-17-0x0000000000400000-0x000000000065A000-memory.dmp

Filesize
2.4MB

Download
memory/3716-18-0x0000000000400000-0x000000000065A000-memory.dmp

Filesize
2.4MB

Download
memory/3716-19-0x0000000000400000-0x000000000065A000-memory.dmp

Filesize
2.4MB

Download