1405b4d3a1a5bc3de785a176547f8702a61f4544ab54195782807002faeb995f

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 12:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1405b4d3a1a5bc3de785a176547f8702a61f4544ab54195782807002faeb995fN.exe
Size

322KB
MD5

ed8c2ea12322063c19f6f295d9e8d5e0
SHA1

fa356bc6030a84a3e95388f155b9f78af92801b4
SHA256

1405b4d3a1a5bc3de785a176547f8702a61f4544ab54195782807002faeb995f
SHA512

bde2f5502ede9bd435bb48a6bb7d9f3ee17874cc5f16317dae2af75a71c875dc35b586fc3a2a48bb9b1174dad860f31d31b8fc32c8f27548fdaa9a339484629b
SSDEEP

6144:uDrUbhmcfz9xAIFHdCI8kAO6v7JIA0PwOK3EwHK/ND:unUbhmchxAMHdCs6JIhQ3EwHKFD

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2772	Cautious Cabinet.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	1405b4d3a1a5bc3de785a176547f8702a61f4544ab54195782807002faeb995fN.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	1405b4d3a1a5bc3de785a176547f8702a61f4544ab54195782807002faeb995fN.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\FundTracker.job	1405b4d3a1a5bc3de785a176547f8702a61f4544ab54195782807002faeb995fN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1405b4d3a1a5bc3de785a176547f8702a61f4544ab54195782807002faeb995fN.exe

C:\Users\Admin\AppData\Local\Temp\1405b4d3a1a5bc3de785a176547f8702a61f4544ab54195782807002faeb995fN.exe
"C:\Users\Admin\AppData\Local\Temp\1405b4d3a1a5bc3de785a176547f8702a61f4544ab54195782807002faeb995fN.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2068

C:\Users\Admin\AppData\Roaming\Cautious Cabinet\Cautious Cabinet.exe
"C:\Users\Admin\AppData\Roaming\Cautious Cabinet\Cautious Cabinet.exe"
1⤵
- Executes dropped EXE
PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Cautious Cabinet\Cautious Cabinet.exe

Filesize
64KB

MD5
dea41652668182ac385bb03434da87c2

SHA1
2bbfe423cef2afb750bbd69ba74859033199f614

SHA256
910ec74b0831560bd181b983b8e74fa4af24d24337520e95a1b04d1925a10cfb

SHA512
1cfc1a6b4c0908ca39993db83c97c20f183f0f33de96a013ab6102cc0521b0cbe484aea2e8783331b6c6131bba93c539c74e4f0c6d384a8da7e94563814e7a4a

Download Submit
memory/2068-1-0x0000000000830000-0x0000000000870000-memory.dmp

Filesize
256KB

Download
memory/2068-2-0x00000000000F0000-0x000000000011F000-memory.dmp

Filesize
188KB

Download
memory/2068-11-0x0000000000140000-0x0000000000167000-memory.dmp

Filesize
156KB

Download