20eacede2596489bafded7f60d9039b65f1214a8be719d35889b3bee89456046

Analysis

max time kernel
126s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 03:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2702d2b17b0b3b95365dbd096d183802.exe
Size

355KB
MD5

2702d2b17b0b3b95365dbd096d183802
SHA1

513f5b6cb4a60e3ac47bbb8bd88f417ca1ad051a
SHA256

20eacede2596489bafded7f60d9039b65f1214a8be719d35889b3bee89456046
SHA512

95c1eb5ee06392e6c908191bb3f19769fe80364b0f0782cd31440011341445c941685fce81a1fe835ff527110c7bb92f3dac2f1387c72290b26aef7745599b51
SSDEEP

6144:1RP5w2XKrEJEF1QDLiYPXPiHrlEZ9hzLRX4lPd4Kyk:1d53X1EFKj/iHK9hPRXIF4Kyk

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	2702d2b17b0b3b95365dbd096d183802.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	2702d2b17b0b3b95365dbd096d183802.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\SearchFunction.job	2702d2b17b0b3b95365dbd096d183802.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1600	1528	WerFault.exe	16

C:\Users\Admin\AppData\Local\Temp\2702d2b17b0b3b95365dbd096d183802.exe
"C:\Users\Admin\AppData\Local\Temp\2702d2b17b0b3b95365dbd096d183802.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:1528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 1200
  2⤵
  - Program crash
  PID:1600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1528 -ip 1528
1⤵
PID:5052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1528-2-0x0000000000E50000-0x0000000000E51000-memory.dmp

Filesize
4KB

Download
memory/1528-3-0x0000000000E30000-0x0000000000E31000-memory.dmp

Filesize
4KB

Download
memory/1528-4-0x0000000000E60000-0x0000000000E89000-memory.dmp

Filesize
164KB

Download
memory/1528-12-0x0000000005160000-0x0000000005187000-memory.dmp

Filesize
156KB

Download
memory/1528-18-0x0000000000E60000-0x0000000000E89000-memory.dmp

Filesize
164KB

Download
memory/1528-16-0x0000000000E60000-0x0000000000E89000-memory.dmp

Filesize
164KB

Download
memory/1528-9-0x0000000000E60000-0x0000000000E89000-memory.dmp

Filesize
164KB

Download
memory/1528-5-0x0000000002140000-0x000000000216F000-memory.dmp

Filesize
188KB

Download
memory/1528-25-0x0000000000E60000-0x0000000000E89000-memory.dmp

Filesize
164KB

Download
memory/1528-1-0x0000000000E40000-0x0000000000E41000-memory.dmp

Filesize
4KB

Download
memory/1528-0-0x0000000000E20000-0x0000000000E21000-memory.dmp

Filesize
4KB

Download