25798ced9a93a32e708077c5a361ffbdae85dcaef6df604fecbf508acfc6d882

Analysis

max time kernel
137s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 20:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25798ced9a93a32e708077c5a361ffbdae85dcaef6df604fecbf508acfc6d882.exe
Size

619KB
MD5

22f12e9cb86b8f8923d5512e90a652ca
SHA1

9c8ce076ef667897396336e7056b3d25d746eaf2
SHA256

25798ced9a93a32e708077c5a361ffbdae85dcaef6df604fecbf508acfc6d882
SHA512

ecc1da60044a71a08e10607d3b3bd877936f6f5cc51e4e52ce99b863c51e0df747c6bfaabae37ab64afec5c4b2be5bb9136835499e4d20320f658de5e319346c
SSDEEP

12288:Q8+B/+JOF5soUUZGoX9EAjmFEKjt6FklfQ3FmLI6tMQkJh5haF5xq:M+QF5scZDt5mFE7i4Ff6tGXTaJq

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	25798ced9a93a32e708077c5a361ffbdae85dcaef6df604fecbf508acfc6d882.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	25798ced9a93a32e708077c5a361ffbdae85dcaef6df604fecbf508acfc6d882.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1292	25798ced9a93a32e708077c5a361ffbdae85dcaef6df604fecbf508acfc6d882.exe
1292	25798ced9a93a32e708077c5a361ffbdae85dcaef6df604fecbf508acfc6d882.exe

C:\Users\Admin\AppData\Local\Temp\25798ced9a93a32e708077c5a361ffbdae85dcaef6df604fecbf508acfc6d882.exe
"C:\Users\Admin\AppData\Local\Temp\25798ced9a93a32e708077c5a361ffbdae85dcaef6df604fecbf508acfc6d882.exe"
1⤵
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:1292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1292-0-0x0000000074F5E000-0x0000000074F5F000-memory.dmp

Filesize
4KB

Download
memory/1292-1-0x0000000000B70000-0x0000000000C10000-memory.dmp

Filesize
640KB

Download
memory/1292-2-0x0000000005590000-0x00000000055C6000-memory.dmp

Filesize
216KB

Download
memory/1292-3-0x0000000005CC0000-0x0000000006264000-memory.dmp

Filesize
5.6MB

Download
memory/1292-4-0x0000000074F5E000-0x0000000074F5F000-memory.dmp

Filesize
4KB

Download
memory/1292-5-0x0000000074F50000-0x0000000075700000-memory.dmp

Filesize
7.7MB

Download
memory/1292-7-0x0000000074F50000-0x0000000075700000-memory.dmp

Filesize
7.7MB

Download