35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242

General

Target

35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe
Size

70KB
MD5

f996872736d023d29f98de5c5c81bb02
SHA1

6e82a8eb165421a060f433eefdd55964dffd9b64
SHA256

35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242
SHA512

f43b8c230e28250e0a88997e0448910c2d73c935f4d841ca993233cae0553351edbd378aa046a696f7164743fa760f1a6aefa0b88c30afcb4df046cba6be9150

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vcnbcamgzbo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe"	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe

description	ioc	process
File opened (read-only)	\??\O:	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe
File opened (read-only)	\??\X:	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe
File opened (read-only)	\??\Z:	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe
File opened (read-only)	\??\A:	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe
File opened (read-only)	\??\B:	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe
File opened (read-only)	\??\J:	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe
File opened (read-only)	\??\K:	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe
File opened (read-only)	\??\N:	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe
File opened (read-only)	\??\I:	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe
File opened (read-only)	\??\T:	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe
File opened (read-only)	\??\Y:	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe
File opened (read-only)	\??\S:	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe
File opened (read-only)	\??\W:	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe
File opened (read-only)	\??\E:	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe
File opened (read-only)	\??\F:	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe
File opened (read-only)	\??\H:	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe
File opened (read-only)	\??\P:	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe
File opened (read-only)	\??\R:	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe
File opened (read-only)	\??\V:	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe
File opened (read-only)	\??\G:	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe
File opened (read-only)	\??\L:	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe
File opened (read-only)	\??\M:	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe
File opened (read-only)	\??\Q:	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe
File opened (read-only)	\??\U:	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe

pid	process
3220	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe
3220	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe
3220	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe
3220	35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe

C:\Users\Admin\AppData\Local\Temp\35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe
"C:\Users\Admin\AppData\Local\Temp\35adcfbd572af9d952b5d3fd5b281d59b80e4833eac1ec949af5bc26a7fc3242.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3220