8bad60c08e9ae705b85b0faf0b99d0eb83270feb1ba2d494f9472628e072436a

General

Target

8bad60c08e9ae705b85b0faf0b99d0eb83270feb1ba2d494f9472628e072436a.exe
Size

389KB
MD5

8e891af483dee89c83d32c63f8d63321
SHA1

9554b38ccbaebffa567f91f1746a681bbb4b9ce0
SHA256

8bad60c08e9ae705b85b0faf0b99d0eb83270feb1ba2d494f9472628e072436a
SHA512

5cc23a5c29cd22c892cd2df91d21a97cb80651fe7d93cc036b9aaff0da6e186854655071cb354664c1977e7c38cef60ccf16b711c668d3db02c18432dab803f9
SSDEEP

12288:r6N7/c5vU0RXcXFM0oIuzO/CB6V2QRwGr:s7/2vzRMXaLzGCBjmr

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	8bad60c08e9ae705b85b0faf0b99d0eb83270feb1ba2d494f9472628e072436a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	8bad60c08e9ae705b85b0faf0b99d0eb83270feb1ba2d494f9472628e072436a.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 588 set thread context of 1504	588	8bad60c08e9ae705b85b0faf0b99d0eb83270feb1ba2d494f9472628e072436a.exe	28
PID 1504 set thread context of 1528	1504	8bad60c08e9ae705b85b0faf0b99d0eb83270feb1ba2d494f9472628e072436a.exe	29

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	8bad60c08e9ae705b85b0faf0b99d0eb83270feb1ba2d494f9472628e072436a.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	8bad60c08e9ae705b85b0faf0b99d0eb83270feb1ba2d494f9472628e072436a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1504	8bad60c08e9ae705b85b0faf0b99d0eb83270feb1ba2d494f9472628e072436a.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 588 wrote to memory of 1504	588	8bad60c08e9ae705b85b0faf0b99d0eb83270feb1ba2d494f9472628e072436a.exe	28
PID 588 wrote to memory of 1504	588	8bad60c08e9ae705b85b0faf0b99d0eb83270feb1ba2d494f9472628e072436a.exe	28
PID 588 wrote to memory of 1504	588	8bad60c08e9ae705b85b0faf0b99d0eb83270feb1ba2d494f9472628e072436a.exe	28
PID 588 wrote to memory of 1504	588	8bad60c08e9ae705b85b0faf0b99d0eb83270feb1ba2d494f9472628e072436a.exe	28
PID 588 wrote to memory of 1504	588	8bad60c08e9ae705b85b0faf0b99d0eb83270feb1ba2d494f9472628e072436a.exe	28
PID 588 wrote to memory of 1504	588	8bad60c08e9ae705b85b0faf0b99d0eb83270feb1ba2d494f9472628e072436a.exe	28
PID 588 wrote to memory of 1504	588	8bad60c08e9ae705b85b0faf0b99d0eb83270feb1ba2d494f9472628e072436a.exe	28
PID 588 wrote to memory of 1504	588	8bad60c08e9ae705b85b0faf0b99d0eb83270feb1ba2d494f9472628e072436a.exe	28
PID 1504 wrote to memory of 1528	1504	8bad60c08e9ae705b85b0faf0b99d0eb83270feb1ba2d494f9472628e072436a.exe	29
PID 1504 wrote to memory of 1528	1504	8bad60c08e9ae705b85b0faf0b99d0eb83270feb1ba2d494f9472628e072436a.exe	29
PID 1504 wrote to memory of 1528	1504	8bad60c08e9ae705b85b0faf0b99d0eb83270feb1ba2d494f9472628e072436a.exe	29
PID 1504 wrote to memory of 1528	1504	8bad60c08e9ae705b85b0faf0b99d0eb83270feb1ba2d494f9472628e072436a.exe	29
PID 1504 wrote to memory of 1528	1504	8bad60c08e9ae705b85b0faf0b99d0eb83270feb1ba2d494f9472628e072436a.exe	29

C:\Users\Admin\AppData\Local\Temp\8bad60c08e9ae705b85b0faf0b99d0eb83270feb1ba2d494f9472628e072436a.exe
"C:\Users\Admin\AppData\Local\Temp\8bad60c08e9ae705b85b0faf0b99d0eb83270feb1ba2d494f9472628e072436a.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:588
- C:\Users\Admin\AppData\Local\Temp\8bad60c08e9ae705b85b0faf0b99d0eb83270feb1ba2d494f9472628e072436a.exe
  "C:\Users\Admin\AppData\Local\Temp\8bad60c08e9ae705b85b0faf0b99d0eb83270feb1ba2d494f9472628e072436a.exe"
  2⤵
  - Maps connected drives based on registry
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Users\Admin\AppData\Local\Temp\8bad60c08e9ae705b85b0faf0b99d0eb83270feb1ba2d494f9472628e072436a.exe
    C:\Users\Admin\AppData\Local\Temp\8bad60c08e9ae705b85b0faf0b99d0eb83270feb1ba2d494f9472628e072436a.exe
    3⤵
    PID:1528

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/588-54-0x00000000763A1000-0x00000000763A3000-memory.dmp

Filesize
8KB

Download
memory/588-55-0x0000000074E90000-0x000000007543B000-memory.dmp

Filesize
5.7MB

Download
memory/588-73-0x0000000074E90000-0x000000007543B000-memory.dmp

Filesize
5.7MB

Download
memory/1504-56-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1504-59-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1504-57-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1504-63-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1504-67-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1504-70-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1504-74-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download

Analysis

Sharing