c41745d8a3ead8489fba5d9ddbadbcc868194da360463eae2d63a0a09c07c19f

Analysis

max time kernel
132s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 01:05

Target

c41745d8a3ead8489fba5d9ddbadbcc868194da360463eae2d63a0a09c07c19f.exe
Size

6.3MB
MD5

6c7b1c7f2a466936f3c06f608358311a
SHA1

14723c060f07a69d9bb5a6d04debccd55b32781d
SHA256

c41745d8a3ead8489fba5d9ddbadbcc868194da360463eae2d63a0a09c07c19f
SHA512

6d31d272eed382edec75873f116d5e49ea02672affaa0bc7e8c8733e1244e245e66ee016eafb25d3c9322f153e02c3538c798c6e74d860464c68acab6d06937b
SSDEEP

98304:Wy2Ra3s45KZATR1DPBLPjmFk1wTdrobphQ7O9CKkq7xb4T0HmphWdo80jT:WM5igRjLik1OibpCyCZT0mpMeT

Score

4^/10

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

c41745d8a3ead8489fba5d9ddbadbcc868194da360463eae2d63a0a09c07c19f.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	c41745d8a3ead8489fba5d9ddbadbcc868194da360463eae2d63a0a09c07c19f.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	c41745d8a3ead8489fba5d9ddbadbcc868194da360463eae2d63a0a09c07c19f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\c41745d8a3ead8489fba5d9ddbadbcc868194da360463eae2d63a0a09c07c19f.exe
"C:\Users\Admin\AppData\Local\Temp\c41745d8a3ead8489fba5d9ddbadbcc868194da360463eae2d63a0a09c07c19f.exe"
1⤵
- Checks system information in the registry
PID:4828

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\ProgramData\netskope\stagent\Logs\nsdebuglog.log
Filesize
4KB

MD5
e98551c96d8a1a7caa45152c69fbbd72

SHA1
524832d51c938b85fc05103139546fd2801b8126

SHA256
053d09a5545d2e280943660229045e84c02bd4b5db746a85838452b75e33c22b

SHA512
294bce083a4e2ba05bd864663032ff47f536609d22c42e9bf6d2a4dc28598cc5d32c66cb06ad625f8facc7ed2a36385e708131851f4aa2fe0661615e48c04757

Download Submit
C:\ProgramData\netskope\stagent\Logs\nsdebuglog.log
Filesize
1KB

MD5
09dae7d4f75dc22e52a5435ba86d78df

SHA1
73e04a54d4414965a5d7fcc13fbbd3a2940455b9

SHA256
b8330514be3e6b98fd0bfc43a5145b5a5e2855a4e91a0290248d8e0b62e6feb4

SHA512
e9501dd2303771db339ac514dbe43453d3e1bb2b306f7572d8f74cb3ac7620385bee0d2da929d6724695189db54f5616109049e6bf2e6b0495f09cf34a407b0d

Download Submit