c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390

General

Target

c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe
Size

164KB
MD5

05bdfc5aae2670314d0b248427a56b36
SHA1

33e1b6b524cbba471ec8638d1cc79e95c2bc415f
SHA256

c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390
SHA512

b2d7bb4ee01dc06e90096ecd558f83a32644b296521082214c485e952b9d36be8419499802d15937c8d51aa47589d99f9025ba139bc4289fc419a5548cd8f333

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe

description	ioc	process
File opened (read-only)	\??\E:	c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe
File opened (read-only)	\??\L:	c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe
File opened (read-only)	\??\T:	c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe
File opened (read-only)	\??\X:	c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe
File opened (read-only)	\??\Y:	c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe
File opened (read-only)	\??\S:	c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe
File opened (read-only)	\??\U:	c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe
File opened (read-only)	\??\V:	c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe
File opened (read-only)	\??\Z:	c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe
File opened (read-only)	\??\R:	c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe
File opened (read-only)	\??\G:	c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe
File opened (read-only)	\??\I:	c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe
File opened (read-only)	\??\J:	c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe
File opened (read-only)	\??\K:	c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe
File opened (read-only)	\??\P:	c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe
File opened (read-only)	\??\N:	c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe
File opened (read-only)	\??\O:	c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe
File opened (read-only)	\??\Q:	c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe
File opened (read-only)	\??\A:	c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe
File opened (read-only)	\??\B:	c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe
File opened (read-only)	\??\F:	c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe
File opened (read-only)	\??\H:	c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe
File opened (read-only)	\??\M:	c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe
File opened (read-only)	\??\W:	c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe

Modifies data under HKEY_USERS 42 IoCs

Processes:

powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exepowershell.exe

pid	process
2608	c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe
2608	c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe
2608	c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe
2608	c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1328	powershell.exe
Token: SeBackupPrivilege	1088	vssvc.exe
Token: SeRestorePrivilege	1088	vssvc.exe
Token: SeAuditPrivilege	1088	vssvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe

description	pid	process	target process
PID 2608 wrote to memory of 1328	2608	c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe	powershell.exe
PID 2608 wrote to memory of 1328	2608	c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe
"C:\Users\Admin\AppData\Local\Temp\c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe"
1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2608

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1328

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:920

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1088

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1328-127-0x00000235B7B60000-0x00000235B7B82000-memory.dmp

Filesize
136KB

Download
memory/1328-131-0x00000235B8660000-0x00000235B86D6000-memory.dmp

Filesize
472KB

Download
memory/1328-143-0x000002359F9A0000-0x00000235B7B60000-memory.dmp

Filesize
385.8MB

Download
memory/1328-144-0x000002359F9A0000-0x00000235B7B60000-memory.dmp

Filesize
385.8MB

Download
memory/2608-118-0x0000000000710000-0x000000000085A000-memory.dmp

Filesize
1.3MB

Download
memory/2608-119-0x0000000000710000-0x000000000085A000-memory.dmp

Filesize
1.3MB

Download
memory/2608-120-0x0000000000710000-0x000000000085A000-memory.dmp

Filesize
1.3MB

Download
memory/2608-121-0x0000000000A50000-0x0000000000A51000-memory.dmp

Filesize
4KB

Download
memory/2608-122-0x0000000000A60000-0x0000000000A66000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads