c41745d8a3ead8489fba5d9ddbadbcc868194da360463eae2d63a0a09c07c19f

Analysis

max time kernel
132s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c41745d8a3ead8489fba5d9ddbadbcc868194da360463eae2d63a0a09c07c19f.exe
Size 6.3MB
Sample240525-bfnwasha61
SHA256 c41745d8a3ead8489fba5d9ddbadbcc868194da360463eae2d63a0a09c07c19f
MD5 6c7b1c7f2a466936f3c06f608358311a
SHA1 14723c060f07a69d9bb5a6d04debccd55b32781d
SHA512 6d31d272eed382edec75873f116d5e49ea02672affaa0bc7e8c8733e1244e245e66ee016eafb25d3c9322f153e02c3538c798c6e74d860464c68acab6d06937b
SSDEEP 98304:Wy2Ra3s45KZATR1DPBLPjmFk1wTdrobphQ7O9CKkq7xb4T0HmphWdo80jT:WM5igRjLik1OibpCyCZT0mpMeT
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

Malware Config

Signatures

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	c41745d8a3ead8489fba5d9ddbadbcc868194da360463eae2d63a0a09c07c19f.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	c41745d8a3ead8489fba5d9ddbadbcc868194da360463eae2d63a0a09c07c19f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\c41745d8a3ead8489fba5d9ddbadbcc868194da360463eae2d63a0a09c07c19f.exe
"C:\Users\Admin\AppData\Local\Temp\c41745d8a3ead8489fba5d9ddbadbcc868194da360463eae2d63a0a09c07c19f.exe"
1⤵
- Checks system information in the registry
PID:4828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nsdebuglog.log

Path C:\ProgramData\netskope\stagent\Logs\nsdebuglog.log
Size 4KB
SHA256 053d09a5545d2e280943660229045e84c02bd4b5db746a85838452b75e33c22b
MD5 e98551c96d8a1a7caa45152c69fbbd72
SHA1 524832d51c938b85fc05103139546fd2801b8126
SHA512 294bce083a4e2ba05bd864663032ff47f536609d22c42e9bf6d2a4dc28598cc5d32c66cb06ad625f8facc7ed2a36385e708131851f4aa2fe0661615e48c04757
SSDEEP 48:Gj8/14SKmbM8iOqCHVrV8AdGGNM112s4P5/p4r46LGT4S4DmGT5/B+5VtTVP/28b:b/a1KoGpv4jmtLU3HH7U1
MD5 SHA1 SHA512 SSDEEP

Submit Download