1459522ad904dbbc0726ba808a85adfa874098d0ab8dc45b96a3ce6950ab83cd

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 04:56 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d63904a3388618a87de1641adb3063b.exe
Size

257KB
MD5

4d63904a3388618a87de1641adb3063b
SHA1

657978186960bd9cf79f3b6790ec1deac36af2d0
SHA256

1459522ad904dbbc0726ba808a85adfa874098d0ab8dc45b96a3ce6950ab83cd
SHA512

fc0f29f7f2e4cd4d67957bb5fe687d3e9187985b8741c62cbc66a9301292a4fd36eed65291186463c2290812622ca2f76ad997d580371f308ee2d834b0bd92dc
SSDEEP

6144:pon0sbF+N6RjxfibTzTD5DiCUrZCelY8n86CN:ns8Y6bDDtivrw58n86CN

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	4d63904a3388618a87de1641adb3063b.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	4d63904a3388618a87de1641adb3063b.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\TheftPrevent.job	4d63904a3388618a87de1641adb3063b.exe

C:\Users\Admin\AppData\Local\Temp\4d63904a3388618a87de1641adb3063b.exe
"C:\Users\Admin\AppData\Local\Temp\4d63904a3388618a87de1641adb3063b.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:1728

Network

DNS

fullset.info

4d63904a3388618a87de1641adb3063b.exe

Remote address:

8.8.8.8:53

Request

fullset.info

IN A

Response
DNS

fullset.info

4d63904a3388618a87de1641adb3063b.exe

Remote address:

8.8.8.8:53

Request

fullset.info

IN A
DNS

fullset.info

4d63904a3388618a87de1641adb3063b.exe

Remote address:

8.8.8.8:53

Request

fullset.info

IN A
DNS

allmodel-pro.com

4d63904a3388618a87de1641adb3063b.exe

Remote address:

8.8.8.8:53

Request

allmodel-pro.com

IN A

Response
DNS

get-multiple.link

4d63904a3388618a87de1641adb3063b.exe

Remote address:

8.8.8.8:53

Request

get-multiple.link

IN A

Response
DNS

moodmodel.biz

4d63904a3388618a87de1641adb3063b.exe

Remote address:

8.8.8.8:53

Request

moodmodel.biz

IN A

Response

No results found

8.8.8.8:53

fullset.info

dns

4d63904a3388618a87de1641adb3063b.exe

174 B
137 B
3
1

DNS Request

fullset.info

DNS Request

fullset.info

DNS Request

fullset.info
8.8.8.8:53

allmodel-pro.com

dns

4d63904a3388618a87de1641adb3063b.exe

62 B
135 B
1
1

DNS Request

allmodel-pro.com
8.8.8.8:53

get-multiple.link

dns

4d63904a3388618a87de1641adb3063b.exe

63 B
136 B
1
1

DNS Request

get-multiple.link
8.8.8.8:53

moodmodel.biz

dns

4d63904a3388618a87de1641adb3063b.exe

59 B
121 B
1
1

DNS Request

moodmodel.biz

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1728-4-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/1728-21-0x0000000000530000-0x0000000000559000-memory.dmp

Filesize
164KB

Download
memory/1728-18-0x0000000000530000-0x0000000000559000-memory.dmp

Filesize
164KB

Download
memory/1728-14-0x0000000000750000-0x0000000000777000-memory.dmp

Filesize
156KB

Download
memory/1728-9-0x0000000000530000-0x0000000000559000-memory.dmp

Filesize
164KB

Download
memory/1728-25-0x0000000000530000-0x0000000000559000-memory.dmp

Filesize
164KB

Download
memory/1728-5-0x0000000000580000-0x00000000005AF000-memory.dmp

Filesize
188KB

Download
memory/1728-3-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1728-2-0x0000000000530000-0x0000000000559000-memory.dmp

Filesize
164KB

Download
memory/1728-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/1728-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.