a707661d26bcaa73c2986d1e528ef65e33aba875afa729b90b1aae00e457654e

General

Target

a707661d26bcaa73c2986d1e528ef65e33aba875afa729b90b1aae00e457654e.exe
Size

24KB
MD5

b0ddc235e52fb1c8c174c0624643c647
SHA1

41cc34a4a36aba8709a48e7cd302e23e901d6495
SHA256

a707661d26bcaa73c2986d1e528ef65e33aba875afa729b90b1aae00e457654e
SHA512

da0cd1d6fe1bb0c1d3b5dde9fb07698a1ccc45b9a093bc2a34155fa1c80886944f8d82f7006521738bb30d638da518e8ed0fe895f13eb81b65556accf9875873

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	a707661d26bcaa73c2986d1e528ef65e33aba875afa729b90b1aae00e457654e.exe
File opened (read-only)	\??\Q:	a707661d26bcaa73c2986d1e528ef65e33aba875afa729b90b1aae00e457654e.exe
File opened (read-only)	\??\Y:	a707661d26bcaa73c2986d1e528ef65e33aba875afa729b90b1aae00e457654e.exe
File opened (read-only)	\??\A:	a707661d26bcaa73c2986d1e528ef65e33aba875afa729b90b1aae00e457654e.exe
File opened (read-only)	\??\E:	a707661d26bcaa73c2986d1e528ef65e33aba875afa729b90b1aae00e457654e.exe
File opened (read-only)	\??\F:	a707661d26bcaa73c2986d1e528ef65e33aba875afa729b90b1aae00e457654e.exe
File opened (read-only)	\??\H:	a707661d26bcaa73c2986d1e528ef65e33aba875afa729b90b1aae00e457654e.exe
File opened (read-only)	\??\J:	a707661d26bcaa73c2986d1e528ef65e33aba875afa729b90b1aae00e457654e.exe
File opened (read-only)	\??\K:	a707661d26bcaa73c2986d1e528ef65e33aba875afa729b90b1aae00e457654e.exe
File opened (read-only)	\??\L:	a707661d26bcaa73c2986d1e528ef65e33aba875afa729b90b1aae00e457654e.exe
File opened (read-only)	\??\N:	a707661d26bcaa73c2986d1e528ef65e33aba875afa729b90b1aae00e457654e.exe
File opened (read-only)	\??\S:	a707661d26bcaa73c2986d1e528ef65e33aba875afa729b90b1aae00e457654e.exe
File opened (read-only)	\??\G:	a707661d26bcaa73c2986d1e528ef65e33aba875afa729b90b1aae00e457654e.exe
File opened (read-only)	\??\P:	a707661d26bcaa73c2986d1e528ef65e33aba875afa729b90b1aae00e457654e.exe
File opened (read-only)	\??\U:	a707661d26bcaa73c2986d1e528ef65e33aba875afa729b90b1aae00e457654e.exe
File opened (read-only)	\??\W:	a707661d26bcaa73c2986d1e528ef65e33aba875afa729b90b1aae00e457654e.exe
File opened (read-only)	\??\Z:	a707661d26bcaa73c2986d1e528ef65e33aba875afa729b90b1aae00e457654e.exe
File opened (read-only)	\??\I:	a707661d26bcaa73c2986d1e528ef65e33aba875afa729b90b1aae00e457654e.exe
File opened (read-only)	\??\M:	a707661d26bcaa73c2986d1e528ef65e33aba875afa729b90b1aae00e457654e.exe
File opened (read-only)	\??\O:	a707661d26bcaa73c2986d1e528ef65e33aba875afa729b90b1aae00e457654e.exe
File opened (read-only)	\??\R:	a707661d26bcaa73c2986d1e528ef65e33aba875afa729b90b1aae00e457654e.exe
File opened (read-only)	\??\T:	a707661d26bcaa73c2986d1e528ef65e33aba875afa729b90b1aae00e457654e.exe
File opened (read-only)	\??\V:	a707661d26bcaa73c2986d1e528ef65e33aba875afa729b90b1aae00e457654e.exe
File opened (read-only)	\??\X:	a707661d26bcaa73c2986d1e528ef65e33aba875afa729b90b1aae00e457654e.exe

C:\Users\Admin\AppData\Local\Temp\a707661d26bcaa73c2986d1e528ef65e33aba875afa729b90b1aae00e457654e.exe
"C:\Users\Admin\AppData\Local\Temp\a707661d26bcaa73c2986d1e528ef65e33aba875afa729b90b1aae00e457654e.exe"
1⤵
- Enumerates connected drives
PID:1152

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/860-2-0x000007FEF72E0000-0x000007FEF755A000-memory.dmp

Filesize
2.5MB

Download

Analysis

Sharing