Analysis
-
max time kernel
118s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
07/11/2022, 21:10
General
-
Target
61cb21951b470664f69004e202cca6823f34741b568cec2e9969455891df18d4.exe
-
Size
678KB
-
MD5
0ff2469598b97a68f33c9ad677a3ea55
-
SHA1
aa0248754db35a93d6e4294dd05e6302eb0764cf
-
SHA256
61cb21951b470664f69004e202cca6823f34741b568cec2e9969455891df18d4
-
SHA512
bdbf8ff2bc95f681b24c66901d1f88ee110d64cd6885f2e0677fc78d07ce1b4004f256696e382a913c746e67ef6afbb7f697e3f84c39b008c99b5529410edac7
-
SSDEEP
12288:QsvoyUpy+YJRdOeyuOI2rNpPnKem/Jjc9hoO:Lv2py+YjbOTNdnKe6i2O
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\61cb21951b470664f69004e202cca6823f34741b568cec2e9969455891df18d4.exe"C:\Users\Admin\AppData\Local\Temp\61cb21951b470664f69004e202cca6823f34741b568cec2e9969455891df18d4.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Documents and Settings\tazebama.dl_"C:\Documents and Settings\tazebama.dl_"2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 7363⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3988 -ip 39881⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2fc 0x3a41⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151KB
MD52d50739b99702f993a2ff82b1c7a4da7
SHA19725ff3ffb6e7223ac12cd815f85db3cbe721c8b
SHA2568c2cc305a3de77bea8fcac1530e1b9ed077fabe6b825ad8dae14c3db30c89fab
SHA512e893486bf7c7ea43eed72ac462a4e2569a69c1799d45470c709a737edab8017734d9186fb08560a2ef6b2d00dd1810721a01decf0cec2333bc6eef9e1fa976b4
-
Filesize
151KB
MD52d50739b99702f993a2ff82b1c7a4da7
SHA19725ff3ffb6e7223ac12cd815f85db3cbe721c8b
SHA2568c2cc305a3de77bea8fcac1530e1b9ed077fabe6b825ad8dae14c3db30c89fab
SHA512e893486bf7c7ea43eed72ac462a4e2569a69c1799d45470c709a737edab8017734d9186fb08560a2ef6b2d00dd1810721a01decf0cec2333bc6eef9e1fa976b4
-
Filesize
32KB
MD5b6a03576e595afacb37ada2f1d5a0529
SHA1d598d4d0e70dec2ffa2849edaeb4db94fedcc0b8
SHA2561707eaf60aa91f3791aa5643bfa038e9d8141878d61f5d701ebac51f4ae7aaad
SHA512181b7cc6479352fe2c53c3630d45a839cdeb74708be6709c2a75847a54de3ffc1fdac8450270dde7174ecb23e5cb002f8ce39032429a3112b1202f3381b8918c
-
Filesize
540KB
-
Filesize
540KB
-
Filesize
540KB
-
Filesize
540KB
-
Filesize
88KB
-
Filesize
88KB