93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05

General

Target

93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe
Size

297KB
MD5

75da8598ae1a3efb9b3034ed81a3bd90
SHA1

01f58af975e8b80930f8bb34ad5ff584400be083
SHA256

93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05
SHA512

c6ad1ddd292810aa8a033396dc6daba6adbdce0f61975a95ae12e8a5561cf3c6d26bb61a2d6a96eec0fe294d22687a560d89e2767a8100ce604e122491da6e96
SSDEEP

6144:sD+nLXGfNWs0F0gYkWgrf2F334WwymP1bdMj1VoE:sD6XwWs0F0gYkWgSF334NP1bdMXX

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe

description	ioc	process
File opened (read-only)	\??\O:	93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe
File opened (read-only)	\??\Z:	93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe
File opened (read-only)	\??\T:	93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe
File opened (read-only)	\??\U:	93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe
File opened (read-only)	\??\W:	93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe
File opened (read-only)	\??\A:	93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe
File opened (read-only)	\??\E:	93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe
File opened (read-only)	\??\P:	93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe
File opened (read-only)	\??\L:	93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe
File opened (read-only)	\??\N:	93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe
File opened (read-only)	\??\R:	93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe
File opened (read-only)	\??\S:	93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe
File opened (read-only)	\??\X:	93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe
File opened (read-only)	\??\I:	93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe
File opened (read-only)	\??\J:	93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe
File opened (read-only)	\??\K:	93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe
File opened (read-only)	\??\H:	93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe
File opened (read-only)	\??\M:	93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe
File opened (read-only)	\??\Q:	93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe
File opened (read-only)	\??\V:	93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe
File opened (read-only)	\??\Y:	93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe
File opened (read-only)	\??\B:	93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe
File opened (read-only)	\??\F:	93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe
File opened (read-only)	\??\G:	93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

544 1712 WerFault.exe 93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe

pid process

1712 93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe

pid	pid_target	process	target process
544	1712	WerFault.exe	93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe

pid	process
1712	93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe
1712	93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe

description	pid	process	target process
PID 1712 wrote to memory of 544	1712	93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe	WerFault.exe
PID 1712 wrote to memory of 544	1712	93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe	WerFault.exe
PID 1712 wrote to memory of 544	1712	93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe	WerFault.exe
PID 1712 wrote to memory of 544	1712	93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe
"C:\Users\Admin\AppData\Local\Temp\93b3fabbc4071e8ca2d781d02acee81670982038dbc0922aba1aa56d7eb13d05.exe"
1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 700
2⤵
- Program crash
PID:544

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/544-55-0x0000000000000000-mapping.dmp

Download
memory/1712-54-0x00000000765B1000-0x00000000765B3000-memory.dmp

Filesize
8KB

Download
memory/1712-56-0x0000000003C00000-0x0000000003C04000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads