23682e885888e4d8f90897e0af580fb0d97f714e165581e3b27110e89603ef22

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 10:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6669bd2a9679ae88d42a6e225344c398.exe
Size

258KB
MD5

6669bd2a9679ae88d42a6e225344c398
SHA1

80ecd8310e83eb4017a712ffd699b70f9f25510e
SHA256

23682e885888e4d8f90897e0af580fb0d97f714e165581e3b27110e89603ef22
SHA512

d5185d88600d222806ef5c7ecb8e462a077e307be4a76a418a0a9dfd2f086b97e261137bafe01b9f628dd168841162e00338e1c1553cfc99a7a7627184efcab4
SSDEEP

6144:IwxRVX3qSsihqg9CRKNpFk2P/ykDGCJjQZvk2:IqaSsOq4CRKNpFB4CJjQZvk2

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	6669bd2a9679ae88d42a6e225344c398.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	6669bd2a9679ae88d42a6e225344c398.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\CaffeineFix.job	6669bd2a9679ae88d42a6e225344c398.exe

C:\Users\Admin\AppData\Local\Temp\6669bd2a9679ae88d42a6e225344c398.exe
"C:\Users\Admin\AppData\Local\Temp\6669bd2a9679ae88d42a6e225344c398.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:1712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1712-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1712-3-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1712-4-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/1712-2-0x00000000000A0000-0x00000000000C9000-memory.dmp

Filesize
164KB

Download
memory/1712-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/1712-5-0x00000000001A0000-0x00000000001CF000-memory.dmp

Filesize
188KB

Download
memory/1712-9-0x00000000000A0000-0x00000000000C9000-memory.dmp

Filesize
164KB

Download
memory/1712-14-0x0000000001100000-0x0000000001127000-memory.dmp

Filesize
156KB

Download
memory/1712-18-0x00000000000A0000-0x00000000000C9000-memory.dmp

Filesize
164KB

Download
memory/1712-22-0x00000000000A0000-0x00000000000C9000-memory.dmp

Filesize
164KB

Download