14023d867e43c08bff3657095bca29d5a50d8fcd0a97673ac6827a4846b05dd0

Analysis

max time kernel
109s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 16:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d025eeec1ef766be46877448d6a83cf.exe
Size

255KB
MD5

7d025eeec1ef766be46877448d6a83cf
SHA1

45bad89bf128f04726c286ab5bed3156ec4610b6
SHA256

14023d867e43c08bff3657095bca29d5a50d8fcd0a97673ac6827a4846b05dd0
SHA512

551dff8a1c2ec1d40f7dabb5044e2cdcfe603300e950ba7b828e1bcd502f19d4d63983823e6bc1fd68e1ccffdf299e1916c3796a12f6d5cff777cde9b4b7a799
SSDEEP

6144:ZdN5AZH+aMOW10GBeXAWWMjB22yBDX+sp:nni+xx6GBOLxjKOsp

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	7d025eeec1ef766be46877448d6a83cf.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	7d025eeec1ef766be46877448d6a83cf.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\FServerPro.job	7d025eeec1ef766be46877448d6a83cf.exe

C:\Users\Admin\AppData\Local\Temp\7d025eeec1ef766be46877448d6a83cf.exe
"C:\Users\Admin\AppData\Local\Temp\7d025eeec1ef766be46877448d6a83cf.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:1764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1764-0-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/1764-1-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/1764-2-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1764-3-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/1764-4-0x00000000005B0000-0x00000000005D9000-memory.dmp

Filesize
164KB

Download
memory/1764-5-0x0000000000DE0000-0x0000000000E0F000-memory.dmp

Filesize
188KB

Download
memory/1764-9-0x00000000005B0000-0x00000000005D9000-memory.dmp

Filesize
164KB

Download
memory/1764-12-0x0000000000E50000-0x0000000000E77000-memory.dmp

Filesize
156KB

Download
memory/1764-20-0x00000000005B0000-0x00000000005D9000-memory.dmp

Filesize
164KB

Download
memory/1764-16-0x00000000005B0000-0x00000000005D9000-memory.dmp

Filesize
164KB

Download
memory/1764-25-0x00000000005B0000-0x00000000005D9000-memory.dmp

Filesize
164KB

Download