Analysis
- max time kernel
90s - max time network
71s - platform
windows10_x64 - resource
win10v20210410 - submitted
26/06/2021, 07:18
Static task
static1
Behavioral task
behavioral1
Sample
92d8c89e8dc92d61a9ff78a304711791.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
92d8c89e8dc92d61a9ff78a304711791.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 92d8c89e8dc92d61a9ff78a304711791.exe
- Size 100KB
- Sample210626-ms592qvlde
- SHA256 0e4c2040ee56cf81df3334e99fb2e419e9ed81a3c9d47bd8f57bb8a95a927baa
- MD5 92d8c89e8dc92d61a9ff78a304711791
- SHA1 70695074806311c4d88e3fe2dd7de30a13c97ba7
- SHA512 90d12b362c2cf8980bbfadaeb9c20c0689ac3a591d971c8fd65e18b394f3d664dccf2e72039719ff056c746a8e72cc64671fccc488e292be55a17b50b1eeacb7
- MD5 SHA1 SHA512
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: 92d8c89e8dc92d61a9ff78a304711791.exe File opened (read-only) \??\B: 92d8c89e8dc92d61a9ff78a304711791.exe File opened (read-only) \??\U: 92d8c89e8dc92d61a9ff78a304711791.exe File opened (read-only) \??\W: 92d8c89e8dc92d61a9ff78a304711791.exe File opened (read-only) \??\P: 92d8c89e8dc92d61a9ff78a304711791.exe File opened (read-only) \??\Q: 92d8c89e8dc92d61a9ff78a304711791.exe File opened (read-only) \??\S: 92d8c89e8dc92d61a9ff78a304711791.exe File opened (read-only) \??\V: 92d8c89e8dc92d61a9ff78a304711791.exe File opened (read-only) \??\J: 92d8c89e8dc92d61a9ff78a304711791.exe File opened (read-only) \??\K: 92d8c89e8dc92d61a9ff78a304711791.exe File opened (read-only) \??\N: 92d8c89e8dc92d61a9ff78a304711791.exe File opened (read-only) \??\R: 92d8c89e8dc92d61a9ff78a304711791.exe File opened (read-only) \??\X: 92d8c89e8dc92d61a9ff78a304711791.exe File opened (read-only) \??\Y: 92d8c89e8dc92d61a9ff78a304711791.exe File opened (read-only) \??\H: 92d8c89e8dc92d61a9ff78a304711791.exe File opened (read-only) \??\L: 92d8c89e8dc92d61a9ff78a304711791.exe File opened (read-only) \??\M: 92d8c89e8dc92d61a9ff78a304711791.exe File opened (read-only) \??\I: 92d8c89e8dc92d61a9ff78a304711791.exe File opened (read-only) \??\O: 92d8c89e8dc92d61a9ff78a304711791.exe File opened (read-only) \??\T: 92d8c89e8dc92d61a9ff78a304711791.exe File opened (read-only) \??\E: 92d8c89e8dc92d61a9ff78a304711791.exe File opened (read-only) \??\F: 92d8c89e8dc92d61a9ff78a304711791.exe File opened (read-only) \??\G: 92d8c89e8dc92d61a9ff78a304711791.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 92d8c89e8dc92d61a9ff78a304711791.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 92d8c89e8dc92d61a9ff78a304711791.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 92d8c89e8dc92d61a9ff78a304711791.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe 3228 92d8c89e8dc92d61a9ff78a304711791.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 3228 92d8c89e8dc92d61a9ff78a304711791.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3228 92d8c89e8dc92d61a9ff78a304711791.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\92d8c89e8dc92d61a9ff78a304711791.exe"C:\Users\Admin\AppData\Local\Temp\92d8c89e8dc92d61a9ff78a304711791.exe"1⤵
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:3228