06d04c7dec828b528aa049fa40a00db23c01ca4d6cb3d02a17d63b0baaae0c25

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

095a3be0302cd9499d5514acb1e3c063.exe
Size

323KB
MD5

095a3be0302cd9499d5514acb1e3c063
SHA1

c6beecc406af7fa8eca6954c2dd28da1375dd350
SHA256

06d04c7dec828b528aa049fa40a00db23c01ca4d6cb3d02a17d63b0baaae0c25
SHA512

d1aed1da8db489b911e052a6fd85e7e7bedf53184b3dddaba12f5a40767d5425ce6d6ae6fbde5f434b51d4540f0f0260e83e5eddad6c6c40743cbec413fee80f
SSDEEP

6144:VAXP0ECVcLui896rs981zpqyvbjwqJvkqr4IFnr:y0Ea+C29j9vkqr4IFnr

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	095a3be0302cd9499d5514acb1e3c063.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	095a3be0302cd9499d5514acb1e3c063.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\HomeStudio.job	095a3be0302cd9499d5514acb1e3c063.exe

C:\Users\Admin\AppData\Local\Temp\095a3be0302cd9499d5514acb1e3c063.exe
"C:\Users\Admin\AppData\Local\Temp\095a3be0302cd9499d5514acb1e3c063.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:4596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4596-0-0x00000000017B0000-0x00000000018B0000-memory.dmp

Filesize
1024KB

Download
memory/4596-2-0x0000000001710000-0x000000000173F000-memory.dmp

Filesize
188KB

Download
memory/4596-9-0x00000000018F0000-0x0000000001917000-memory.dmp

Filesize
156KB

Download