cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad

Analysis

max time kernel
45s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 19:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad.exe
Size

707KB
MD5

08f6787221016ef38abaff7c7418c23d
SHA1

c28219c4867b1f7f06a949acd39d83726d9f7b7b
SHA256

cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad
SHA512

60da549ad9d9c9fdb9dce9a324971f7b9db4a4bf2ef5f5d62e710e8b6b50925a3298a5786d17a89f6fa30715759a57717f64897b1d2da13d80ae433f7f9717e3
SSDEEP

6144:iv27jyGy1/pEli1TQXG3QsE0VdQTQRwvwjvaIy7N:6/Fpl1UXGRVpw4jyIy

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1376-54-0x0000000000400000-0x0000000000471000-memory.dmp	upx

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad.exe
File opened (read-only)	\??\G:	cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad.exe
File opened (read-only)	\??\R:	cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad.exe
File opened (read-only)	\??\B:	cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad.exe
File opened (read-only)	\??\I:	cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad.exe
File opened (read-only)	\??\L:	cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad.exe
File opened (read-only)	\??\N:	cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad.exe
File opened (read-only)	\??\Q:	cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad.exe
File opened (read-only)	\??\S:	cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad.exe
File opened (read-only)	\??\U:	cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad.exe
File opened (read-only)	\??\X:	cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad.exe
File opened (read-only)	\??\A:	cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad.exe
File opened (read-only)	\??\Z:	cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad.exe
File opened (read-only)	\??\H:	cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad.exe
File opened (read-only)	\??\J:	cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad.exe
File opened (read-only)	\??\K:	cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad.exe
File opened (read-only)	\??\O:	cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad.exe
File opened (read-only)	\??\P:	cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad.exe
File opened (read-only)	\??\T:	cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad.exe
File opened (read-only)	\??\E:	cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad.exe
File opened (read-only)	\??\V:	cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad.exe
File opened (read-only)	\??\W:	cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad.exe
File opened (read-only)	\??\Y:	cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad.exe
File opened (read-only)	\??\M:	cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad.exe
File opened for modification	C:\autorun.inf	cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\NetInfo.exe	cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad.exe
File opened for modification	C:\Windows\SysWOW64\NetInfo.exe	cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1376	cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad.exe

C:\Users\Admin\AppData\Local\Temp\cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad.exe
"C:\Users\Admin\AppData\Local\Temp\cff71362dab7e3b7c7bd55830d31f211d561dc7d21bbfee1a216f4f96bfb27ad.exe"
1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1376