23258d254aff989c651f8dbe8fce1c1fc6f3c19f853605e87ca6ab6417092dbb

Analysis

max time kernel
148s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 00:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

51fefb8981cf7f8b793a5c44bb923598.exe
Size

325KB
MD5

51fefb8981cf7f8b793a5c44bb923598
SHA1

7c066da8ec77f10716275d1ad3daa142c94ae931
SHA256

23258d254aff989c651f8dbe8fce1c1fc6f3c19f853605e87ca6ab6417092dbb
SHA512

e4e4546dc52e41c837e51f6bc89c36fa6de816d8ee8cec66c276f1516986897a2f8d5aea0414ca280d6f18d88ee326e31359fb4d52e8b9f33c84052bb032cf65
SSDEEP

6144:JjEmMhzjbsz3Wsv1b51VyM94YviaT2nB+N4bbkPZ6gEFP:9EmM1szr1kMTiaTa+N4bbkh7EFP

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	51fefb8981cf7f8b793a5c44bb923598.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	51fefb8981cf7f8b793a5c44bb923598.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\StylishPlanner.job	51fefb8981cf7f8b793a5c44bb923598.exe

C:\Users\Admin\AppData\Local\Temp\51fefb8981cf7f8b793a5c44bb923598.exe
"C:\Users\Admin\AppData\Local\Temp\51fefb8981cf7f8b793a5c44bb923598.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2908-0-0x0000000000DE0000-0x0000000000EE0000-memory.dmp

Filesize
1024KB

Download
memory/2908-2-0x0000000000F40000-0x0000000000F6F000-memory.dmp

Filesize
188KB

Download
memory/2908-9-0x0000000004720000-0x0000000004747000-memory.dmp

Filesize
156KB

Download