4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463

Analysis

max time kernel
117s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 21:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463.exe
Size

621KB
MD5

02bb4e3c726e0d22f655cd8f92ac5ff0
SHA1

dc3255cba49c248bc3d9f4c576b2f5b55d268166
SHA256

4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463
SHA512

93ca81f6fb67a0dc0a230247a29c13a284c1ea4dbcceca55762c622ca81acb7ad372f884c3fbc74f489f9715a4ba28023c99f602e774c6ebe5fba81fd280e9c9
SSDEEP

12288:q5aCuQUY0nJRzaw2s0kCttOD6khIB5Adfzhe/4eQ5tXez3AcMwE4rNIbwFP:qkCu3zj2w96ODg5+fzC4eQrX6A/38FP

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463.exe
File opened (read-only)	\??\M:	4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463.exe
File opened (read-only)	\??\O:	4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463.exe
File opened (read-only)	\??\W:	4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463.exe
File opened (read-only)	\??\A:	4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463.exe
File opened (read-only)	\??\B:	4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463.exe
File opened (read-only)	\??\G:	4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463.exe
File opened (read-only)	\??\I:	4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463.exe
File opened (read-only)	\??\Q:	4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463.exe
File opened (read-only)	\??\T:	4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463.exe
File opened (read-only)	\??\U:	4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463.exe
File opened (read-only)	\??\V:	4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463.exe
File opened (read-only)	\??\E:	4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463.exe
File opened (read-only)	\??\F:	4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463.exe
File opened (read-only)	\??\L:	4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463.exe
File opened (read-only)	\??\P:	4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463.exe
File opened (read-only)	\??\Y:	4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463.exe
File opened (read-only)	\??\Z:	4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463.exe
File opened (read-only)	\??\R:	4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463.exe
File opened (read-only)	\??\S:	4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463.exe
File opened (read-only)	\??\X:	4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463.exe
File opened (read-only)	\??\H:	4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463.exe
File opened (read-only)	\??\J:	4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463.exe
File opened (read-only)	\??\N:	4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1132	692	WerFault.exe	83

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	692	4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463.exe
Token: SeCreatePagefilePrivilege	692	4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
692	4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463.exe
692	4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463.exe

C:\Users\Admin\AppData\Local\Temp\4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463.exe
"C:\Users\Admin\AppData\Local\Temp\4b14411648a7bd31c4bdfb6ef6969199b918b6ab4474b33e7f888f8c66027463.exe"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 692 -s 460
  2⤵
  - Program crash
  PID:1132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 692 -ip 692
1⤵
PID:2844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/692-132-0x0000000000400000-0x0000000000679000-memory.dmp

Filesize
2.5MB

Download
memory/692-133-0x0000000000400000-0x0000000000679000-memory.dmp

Filesize
2.5MB

Download