3adabfeb0315eb41c2a2d48c18895d313e40f6feab0bd3a54888541702d7e98f

Analysis

max time kernel
142s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fbcf546a08d47968dede96b8b121c441.exe
Size

20KB
MD5

fbcf546a08d47968dede96b8b121c441
SHA1

423e57e4ecaad1dba70b91b8f7999d0d417102ab
SHA256

3adabfeb0315eb41c2a2d48c18895d313e40f6feab0bd3a54888541702d7e98f
SHA512

1b8576b50da2623631fbf3af6f212cddf717e8d425ad8c2f85b546044d61e952aac4512713b18b48174bce910ae69271dbd5dc5f34b020d835a111edd15e888b
SSDEEP

384:7LZPnqGM39DCRF9NgffxnJqbYJwE90lcRmwj7qnOXHTam9xO:Vr+wRF9NgfftJqbLE2lYjKSmm9xO

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	fbcf546a08d47968dede96b8b121c441.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	fbcf546a08d47968dede96b8b121c441.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2044	fbcf546a08d47968dede96b8b121c441.exe

C:\Users\Admin\AppData\Local\Temp\fbcf546a08d47968dede96b8b121c441.exe
"C:\Users\Admin\AppData\Local\Temp\fbcf546a08d47968dede96b8b121c441.exe"
1⤵
- Maps connected drives based on registry
- Suspicious behavior: RenamesItself
PID:2044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2044-2-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download