d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3

General

Target

d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
Size

522KB
MD5

0dc349ee61670a3c1ab82968bfed7960
SHA1

38938771a9d3fd2f915bb3351e3839d1673c1b71
SHA256

d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3
SHA512

7387101c5f436473d88ed3683c6d9f02da2f3ba6d63c9d1c4fc8f0a5bf5c4c925d3372a3988d8e544dab5b8fb61fe624311aaf11a8d7ec38e1cbf6ad61699c6e
SSDEEP

12288:LQeN/7YkrWBfWhvRhQUCwjjTMaSV65hFd:LQeN/7DSBfWhbjaV6rF

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File opened (read-only)	\??\O:	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File opened (read-only)	\??\T:	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File opened (read-only)	\??\Z:	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File opened (read-only)	\??\K:	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File opened (read-only)	\??\J:	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File opened (read-only)	\??\Y:	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File opened (read-only)	\??\F:	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File opened (read-only)	\??\I:	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File opened (read-only)	\??\L:	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File opened (read-only)	\??\P:	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File opened (read-only)	\??\V:	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File opened (read-only)	\??\X:	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File opened (read-only)	\??\E:	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File opened (read-only)	\??\H:	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File opened (read-only)	\??\N:	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File opened (read-only)	\??\Q:	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File opened (read-only)	\??\R:	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File opened (read-only)	\??\S:	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File opened (read-only)	\??\U:	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File opened (read-only)	\??\W:	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File opened (read-only)	\??\G:	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.ivr	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File created	C:\Program Files\7-Zip\Uninstall.ivr	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3160	2492	WerFault.exe	78
1432	2492	WerFault.exe	78

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2492	d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe

C:\Users\Admin\AppData\Local\Temp\d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe
"C:\Users\Admin\AppData\Local\Temp\d5292bdbfc6749ec207210a38b826416f1e2e6f33d2e0ff8c3b0f17b2ffc08d3.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 1104
  2⤵
  - Program crash
  PID:3160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 1112
  2⤵
  - Program crash
  PID:1432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2492 -ip 2492
1⤵
PID:5004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2492 -ip 2492
1⤵
PID:4108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2492-132-0x000000004AD00000-0x000000004ADAB000-memory.dmp

Filesize
684KB

Download
memory/2492-133-0x000000004AD00000-0x000000004ADAB000-memory.dmp

Filesize
684KB

Download

Analysis

Sharing