f6b8ea26ebf3a56f50d59b335d895057e18dd455597b6bd88b8cb848f077ebff

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 07:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6b8ea26ebf3a56f50d59b335d895057e18dd455597b6bd88b8cb848f077ebff.exe
Size

829KB
MD5

d14033aa30fb99f267190f8d9066bc2d
SHA1

2954b26dee7c4a0825f48f117b4139d1537d9ae7
SHA256

f6b8ea26ebf3a56f50d59b335d895057e18dd455597b6bd88b8cb848f077ebff
SHA512

416b920c7dff012a0aeefeeff37ce1a49f56d8a810f04559b1a6220bdb6cf759878036eb43c75fdedf9282013d3816c80b1ae30f9c88e3bf42c66f1fd54c30aa
SSDEEP

12288:+vhydW/MZxOJgaP80g4Q+m14LmPrdcz1ZlAH3mSHd:WpQ+rmKz1Zl3SHd

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 7 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	f6b8ea26ebf3a56f50d59b335d895057e18dd455597b6bd88b8cb848f077ebff.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	f6b8ea26ebf3a56f50d59b335d895057e18dd455597b6bd88b8cb848f077ebff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	f6b8ea26ebf3a56f50d59b335d895057e18dd455597b6bd88b8cb848f077ebff.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	f6b8ea26ebf3a56f50d59b335d895057e18dd455597b6bd88b8cb848f077ebff.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings	f6b8ea26ebf3a56f50d59b335d895057e18dd455597b6bd88b8cb848f077ebff.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	f6b8ea26ebf3a56f50d59b335d895057e18dd455597b6bd88b8cb848f077ebff.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	f6b8ea26ebf3a56f50d59b335d895057e18dd455597b6bd88b8cb848f077ebff.exe

C:\Users\Admin\AppData\Local\Temp\f6b8ea26ebf3a56f50d59b335d895057e18dd455597b6bd88b8cb848f077ebff.exe
"C:\Users\Admin\AppData\Local\Temp\f6b8ea26ebf3a56f50d59b335d895057e18dd455597b6bd88b8cb848f077ebff.exe"
1⤵
- Modifies registry class
PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2064-0-0x00007FF7D5100000-0x00007FF7D51AE000-memory.dmp

Filesize
696KB

Download