c12bc61cbede187a1df716489f401838627c64fee2bca00f658c6c06d85cd9a5

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
12-09-2024 06:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c12bc61cbede187a1df716489f401838627c64fee2bca00f658c6c06d85cd9a5.exe
Size

3.0MB
MD5

f9db81c63e9309ecd9c8d2859d85f2f2
SHA1

69ef6090c36ce9ddf16c2831060b8c88ef570165
SHA256

c12bc61cbede187a1df716489f401838627c64fee2bca00f658c6c06d85cd9a5
SHA512

6e9206becbb1296f35421f8f95bc3e377bcb498004b910b636fdf6866a83b8b225fc83fa10e9deaf9bf2baf4fb2d35e882e8539a6d872424c29ec348c4d556db
SSDEEP

49152:xgcn3NSeG1T4lcCwVJMA4rYn5WPp4ydxRr94j:QS

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	c12bc61cbede187a1df716489f401838627c64fee2bca00f658c6c06d85cd9a5.exe
File opened (read-only)	\??\F:	c12bc61cbede187a1df716489f401838627c64fee2bca00f658c6c06d85cd9a5.exe

C:\Users\Admin\AppData\Local\Temp\c12bc61cbede187a1df716489f401838627c64fee2bca00f658c6c06d85cd9a5.exe
"C:\Users\Admin\AppData\Local\Temp\c12bc61cbede187a1df716489f401838627c64fee2bca00f658c6c06d85cd9a5.exe"
1⤵
- Enumerates connected drives
PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2684-0-0x000000013F710000-0x000000013FB32000-memory.dmp

Filesize
4.1MB

Download
memory/2684-1-0x000000013F710000-0x000000013FB32000-memory.dmp

Filesize
4.1MB

Download