d7249002b3af2889df2e9298001c561bcb9c7ef9aa67259b8efb2552a02f465e

Analysis

max time kernel
148s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 09:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21QAGames/Down/Down21QA.exe
Size

415KB
MD5

fa62548f3cc714f7ee3b3c828d60b5b4
SHA1

0bd694fe6b57fbc2b31371e786b79707de18c455
SHA256

f258212124e50cfd7b0c5b344e8bf5d89d3422600e99e5a040495a17f11f0fff
SHA512

9b2f72d3ce6863bb068e24d7365c0de505fe804917010a4928009a18979c6ea90208f465aaf2ecca4fc27610d9ac5f99e5f5094c8f11e633730b3c91bcd81327
SSDEEP

6144:WqQbfVSVlHcF0zehD6stVfR7tKkULIEpXgaf6hF7c5YFO3GGzJXm6jAlB03TO6Bl:CSVlcezehN1iFB+NhF7/EJWOu03Td

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5092	Down21QA.exe

C:\Users\Admin\AppData\Local\Temp\21QAGames\Down\Down21QA.exe
"C:\Users\Admin\AppData\Local\Temp\21QAGames\Down\Down21QA.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:5092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5092-0-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/5092-1-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/5092-3-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download