24676abe0080e24635255720e4f319524536bbdec00ba39f99b920c0a5063f8f

Analysis

max time kernel
146s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 04:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5598578ba0806944a27f2bc2587bce34.exe
Size

252KB
MD5

5598578ba0806944a27f2bc2587bce34
SHA1

6b40b0c8f0e19ae5a306363ac2eca30fde62e09a
SHA256

24676abe0080e24635255720e4f319524536bbdec00ba39f99b920c0a5063f8f
SHA512

58de8ca18dbdb256f1f84e3a9bf864d4d656c46e5d87dcd24877e27493453120fef3566c7ec090eb2214393d2a84db2881c934448332201f3769dcdf8025043a
SSDEEP

6144:2KB6v2BCavvE1w6r0Y4sT34xOwT/nebxgznhqnWe5oLdqojd:U2L01wi0jvx9sxgzhxLwojd

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	5598578ba0806944a27f2bc2587bce34.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	5598578ba0806944a27f2bc2587bce34.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\QuickRecipe.job	5598578ba0806944a27f2bc2587bce34.exe

C:\Users\Admin\AppData\Local\Temp\5598578ba0806944a27f2bc2587bce34.exe
"C:\Users\Admin\AppData\Local\Temp\5598578ba0806944a27f2bc2587bce34.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2072-1-0x0000000000B00000-0x0000000000B01000-memory.dmp

Filesize
4KB

Download
memory/2072-0-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Filesize
4KB

Download
memory/2072-2-0x0000000000B10000-0x0000000000B11000-memory.dmp

Filesize
4KB

Download
memory/2072-3-0x0000000000B30000-0x0000000000B31000-memory.dmp

Filesize
4KB

Download
memory/2072-4-0x0000000000B40000-0x0000000000B69000-memory.dmp

Filesize
164KB

Download
memory/2072-5-0x00000000021E0000-0x000000000220F000-memory.dmp

Filesize
188KB

Download
memory/2072-9-0x0000000000B40000-0x0000000000B69000-memory.dmp

Filesize
164KB

Download
memory/2072-12-0x0000000005230000-0x0000000005257000-memory.dmp

Filesize
156KB

Download
memory/2072-16-0x0000000000B40000-0x0000000000B69000-memory.dmp

Filesize
164KB

Download
memory/2072-17-0x0000000000B40000-0x0000000000B69000-memory.dmp

Filesize
164KB

Download