e9b24041847844a5d57b033bf0b41dc637eba7664acfb43da5db635ae920a1b4

General

Target

e9b24041847844a5d57b033bf0b41dc637eba7664acfb43da5db635ae920a1b4.exe
Size

79KB
MD5

936593e1ba2e1fefc78389ed40ab9d9a
SHA1

dce566c765b39bca870e374c7f973b432a633fb3
SHA256

e9b24041847844a5d57b033bf0b41dc637eba7664acfb43da5db635ae920a1b4
SHA512

21d3f5f00be88041ee4839a776ed8e7428bcb1e8172d4c4f9af2a7b782c3f89fc4dd57402dbf77d24664b8a99d2d330dc8b231d9d7037564bbc9276c49633017

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	mstsc.exe
File opened (read-only)	\??\W:	mstsc.exe
File opened (read-only)	\??\X:	mstsc.exe
File opened (read-only)	\??\Y:	mstsc.exe
File opened (read-only)	\??\A:	mstsc.exe
File opened (read-only)	\??\M:	mstsc.exe
File opened (read-only)	\??\N:	mstsc.exe
File opened (read-only)	\??\R:	mstsc.exe
File opened (read-only)	\??\B:	mstsc.exe
File opened (read-only)	\??\O:	mstsc.exe
File opened (read-only)	\??\E:	mstsc.exe
File opened (read-only)	\??\I:	mstsc.exe
File opened (read-only)	\??\T:	mstsc.exe
File opened (read-only)	\??\U:	mstsc.exe
File opened (read-only)	\??\K:	mstsc.exe
File opened (read-only)	\??\L:	mstsc.exe
File opened (read-only)	\??\P:	mstsc.exe
File opened (read-only)	\??\Q:	mstsc.exe
File opened (read-only)	\??\F:	mstsc.exe
File opened (read-only)	\??\G:	mstsc.exe
File opened (read-only)	\??\H:	mstsc.exe
File opened (read-only)	\??\J:	mstsc.exe
File opened (read-only)	\??\V:	mstsc.exe
File opened (read-only)	\??\Z:	mstsc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1520	1208	WerFault.exe	24

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1520	WerFault.exe
1520	WerFault.exe
1520	WerFault.exe
1520	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1520	WerFault.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1896	mstsc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 1520	1208	e9b24041847844a5d57b033bf0b41dc637eba7664acfb43da5db635ae920a1b4.exe	26
PID 1208 wrote to memory of 1520	1208	e9b24041847844a5d57b033bf0b41dc637eba7664acfb43da5db635ae920a1b4.exe	26
PID 1208 wrote to memory of 1520	1208	e9b24041847844a5d57b033bf0b41dc637eba7664acfb43da5db635ae920a1b4.exe	26
PID 1208 wrote to memory of 1520	1208	e9b24041847844a5d57b033bf0b41dc637eba7664acfb43da5db635ae920a1b4.exe	26

C:\Users\Admin\AppData\Local\Temp\e9b24041847844a5d57b033bf0b41dc637eba7664acfb43da5db635ae920a1b4.exe
"C:\Users\Admin\AppData\Local\Temp\e9b24041847844a5d57b033bf0b41dc637eba7664acfb43da5db635ae920a1b4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 88
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1520

C:\Windows\system32\mstsc.exe
"C:\Windows\system32\mstsc.exe"
1⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:1896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1520-64-0x0000000075C71000-0x0000000075C73000-memory.dmp

Filesize
8KB

Download
memory/1520-65-0x0000000000210000-0x0000000000228000-memory.dmp

Filesize
96KB

Download
memory/1896-60-0x000007FEFB9F1000-0x000007FEFB9F3000-memory.dmp

Filesize
8KB

Download
memory/1896-62-0x000007FEF5E11000-0x000007FEF5E13000-memory.dmp

Filesize
8KB

Download
memory/1896-63-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing