Analysis
-
max time kernel
181s -
max time network
213s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2023 12:45
Static task
static1
Behavioral task
behavioral1
Sample
6f8547738b5416d5183e11e78b4e6134.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6f8547738b5416d5183e11e78b4e6134.exe
Resource
win10v2004-20231215-en
General
-
Target
6f8547738b5416d5183e11e78b4e6134.exe
-
Size
304KB
-
MD5
6f8547738b5416d5183e11e78b4e6134
-
SHA1
cbb4ce07cef16b72218b1bf6f527a4d775dfde50
-
SHA256
04616c7cb34b88062545dbb9fe5baf92ab5f3283c740aea29db74e14a7d12e32
-
SHA512
344937afda732edcf6f61bc9d48ced628c966bcb78fe23a125e31bdf15bf153bcbe218fa794d3614a507225adb9affd9d61828ea3b7a7e1176263cee4fc7d8ee
-
SSDEEP
6144:drkx9uEo2S1YnQmCX492DkwNP3qpYFkXdlP5IO5/OoCVHuy6SHZ86riVZkiizk:drkHu6/eIo4RXdrIO5/OpVHd6Ky6riz5
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 1844 6f8547738b5416d5183e11e78b4e6134.exe 1844 6f8547738b5416d5183e11e78b4e6134.exe 1844 6f8547738b5416d5183e11e78b4e6134.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 6f8547738b5416d5183e11e78b4e6134.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum 6f8547738b5416d5183e11e78b4e6134.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1844 6f8547738b5416d5183e11e78b4e6134.exe 1844 6f8547738b5416d5183e11e78b4e6134.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
269KB
MD5af7ce801c8471c5cd19b366333c153c4
SHA14267749d020a362edbd25434ad65f98b073581f1
SHA256cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e
SHA51288655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c
-
Filesize
73KB
MD5e8d86c771d7e23b080921b9803f1654c
SHA149d8ef6835a6de734ead4e0b2cbbc65735cd5c17
SHA256cc7a340bffc39d8d8f704314f0383404590438b8cd16e780e0a26723bceedd21
SHA512b9902e0112bbf053ec4e3aa633ac2f2dd938b23507ff58ed69ac580656e42874c4b0ccb0d393b26637ae2b98feee78023d62378adb99140736e314de74fb399b
-
Filesize
167KB
MD5262cc5a5e5a007ae182c45e41ac35adf
SHA1999582209e73d92d0040b8092666087aac2cee90
SHA256ecc186e0284593db51463f104ba8486b1de656d47a290d27c6fea157cb1495bd
SHA5122f59e23646774c3e5034d464242ac128cfb3ced1a0498dd0f719308b5854fbba20d457127e01b414f12b63d8bc3baf7ffcf89d91300ca43b90ed6cc933e4bd5b