d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25

General

Target
d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe
Size 70KB
Sample210227-2f4v2nce56
SHA256 d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25
MD5 0e1f770502b3345b805acd9b08a186f2
SHA1 b3ef02f7fe4b404e16f050bc29c762f3a13a89e6
SHA512 d275738306ae18434054236294d145a97d4e28591a54609c29971cf618535b720df4d1a666ed83f27c29eb8acbbd47094a7f1a0f1968f332171946f5ef51152e
MD5 SHA1 SHA512

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\flqroedtupm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe"	d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe
File opened (read-only)	\??\L:	d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe
File opened (read-only)	\??\N:	d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe
File opened (read-only)	\??\Q:	d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe
File opened (read-only)	\??\S:	d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe
File opened (read-only)	\??\T:	d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe
File opened (read-only)	\??\Z:	d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe
File opened (read-only)	\??\A:	d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe
File opened (read-only)	\??\F:	d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe
File opened (read-only)	\??\J:	d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe
File opened (read-only)	\??\M:	d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe
File opened (read-only)	\??\O:	d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe
File opened (read-only)	\??\P:	d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe
File opened (read-only)	\??\I:	d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe
File opened (read-only)	\??\R:	d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe
File opened (read-only)	\??\U:	d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe
File opened (read-only)	\??\X:	d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe
File opened (read-only)	\??\Y:	d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe
File opened (read-only)	\??\E:	d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe
File opened (read-only)	\??\G:	d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe
File opened (read-only)	\??\H:	d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe
File opened (read-only)	\??\K:	d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe
File opened (read-only)	\??\V:	d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe
File opened (read-only)	\??\W:	d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1864	d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe
1864	d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe

C:\Users\Admin\AppData\Local\Temp\d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe
"C:\Users\Admin\AppData\Local\Temp\d068af26c68439ffa96df8befe36f69ff6b3398a7d7932cd8058c48fb305ed25.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1864