Analysis
-
max time kernel
150s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
07/11/2022, 21:09
General
-
Target
93e5473b58b719f93234a6c7d46268e89709582114132c5f7669881d6f6fe740.exe
-
Size
433KB
-
MD5
0ee1e851c1888eca00d5884b2d4998b3
-
SHA1
46ef7ca9969dfd8421294869fb38261c31415a22
-
SHA256
93e5473b58b719f93234a6c7d46268e89709582114132c5f7669881d6f6fe740
-
SHA512
fefded9ca47ec096cf0053ab2d7df558ad27829d1e816beab45e0f8fd0adb212a43d20c468de8713a277d9cf6af90518bdf75127a4eee437a1ac6b32cf43fc6d
-
SSDEEP
6144:hqKFh6MBn1++g0UIgqVwexd8pySfEJ7EAE2jOXzAarx+2UpuTYmqjmTJ:hnFhr1+h0UjqVwexdQ/4/sE2JT7qKl
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\93e5473b58b719f93234a6c7d46268e89709582114132c5f7669881d6f6fe740.exe"C:\Users\Admin\AppData\Local\Temp\93e5473b58b719f93234a6c7d46268e89709582114132c5f7669881d6f6fe740.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Documents and Settings\tazebama.dl_"C:\Documents and Settings\tazebama.dl_"2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 7283⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4072 -ip 40721⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4a0 0x2401⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
157KB
MD57371e1a46c3f3abe4e1272c9d5ee1bf8
SHA1e0f4dea6cbefe6830601114fabd8238c13167dda
SHA2567dc4c14f775ffd3b4bba732aa15255f56e4cd4e09397d654507eebc03f9c84c7
SHA512e9752187371fb732fe5de5ed97630660eaf318da13bcab9a175ccd0d0a9b306a91cc8d126efa686e972b76713fb6923106468f8c0a3d059c95deb49f19c828dc
-
Filesize
157KB
MD57371e1a46c3f3abe4e1272c9d5ee1bf8
SHA1e0f4dea6cbefe6830601114fabd8238c13167dda
SHA2567dc4c14f775ffd3b4bba732aa15255f56e4cd4e09397d654507eebc03f9c84c7
SHA512e9752187371fb732fe5de5ed97630660eaf318da13bcab9a175ccd0d0a9b306a91cc8d126efa686e972b76713fb6923106468f8c0a3d059c95deb49f19c828dc
-
Filesize
32KB
MD5b6a03576e595afacb37ada2f1d5a0529
SHA1d598d4d0e70dec2ffa2849edaeb4db94fedcc0b8
SHA2561707eaf60aa91f3791aa5643bfa038e9d8141878d61f5d701ebac51f4ae7aaad
SHA512181b7cc6479352fe2c53c3630d45a839cdeb74708be6709c2a75847a54de3ffc1fdac8450270dde7174ecb23e5cb002f8ce39032429a3112b1202f3381b8918c
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
96KB
-
Filesize
96KB