6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408

General

Target

6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe
Size

215KB
MD5

e71825acc5c0dbf948ec73b12c397a23
SHA1

efe7521f2f6f06840418ca99b57989ec7dd797c5
SHA256

6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408
SHA512

c9369d2a89f54250149b3a92d1d12b2f1a38fcf76e961d08f5ea4c3aec29bc338d8d5113df0bdd35aed5ff2d4c2d71ac3195e27d72489d9275553833314d7fe5
SSDEEP

6144:cyJE1yd7WEJmcyf70PWna4DQFu/U3buRKlemZ9DnGAevIGn+:cU/d7WRvIPWa4DQFu/U3buRKlemZ9DnG

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe

description	ioc	Process
File opened (read-only)	\??\Y:	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe
File opened (read-only)	\??\O:	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe
File opened (read-only)	\??\M:	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe
File opened (read-only)	\??\G:	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe
File opened (read-only)	\??\F:	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe
File opened (read-only)	\??\B:	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe
File opened (read-only)	\??\X:	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe
File opened (read-only)	\??\L:	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe
File opened (read-only)	\??\K:	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe
File opened (read-only)	\??\J:	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe
File opened (read-only)	\??\A:	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe
File opened (read-only)	\??\W:	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe
File opened (read-only)	\??\V:	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe
File opened (read-only)	\??\R:	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe
File opened (read-only)	\??\Q:	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe
File opened (read-only)	\??\P:	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe
File opened (read-only)	\??\N:	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe
File opened (read-only)	\??\H:	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe
File opened (read-only)	\??\Z:	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe
File opened (read-only)	\??\U:	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe
File opened (read-only)	\??\T:	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe
File opened (read-only)	\??\S:	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe
File opened (read-only)	\??\I:	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe
File opened (read-only)	\??\E:	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe

Drops file in Program Files directory 1 IoCs

Processes:

6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe

description	ioc	Process
File created	C:\Program Files\.sys	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe

description	pid	Process	procid_target
PID 1900 wrote to memory of 1072	1900	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe	82
PID 1900 wrote to memory of 1072	1900	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe	82
PID 1900 wrote to memory of 1072	1900	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe	82
PID 1900 wrote to memory of 4804	1900	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe	84
PID 1900 wrote to memory of 4804	1900	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe	84
PID 1900 wrote to memory of 4804	1900	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe	84
PID 1900 wrote to memory of 3032	1900	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe	85
PID 1900 wrote to memory of 3032	1900	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe	85
PID 1900 wrote to memory of 3032	1900	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe	85
PID 1900 wrote to memory of 3116	1900	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe	86
PID 1900 wrote to memory of 3116	1900	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe	86
PID 1900 wrote to memory of 3116	1900	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe	86
PID 1900 wrote to memory of 3228	1900	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe	87
PID 1900 wrote to memory of 3228	1900	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe	87
PID 1900 wrote to memory of 3228	1900	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe	87
PID 1900 wrote to memory of 3132	1900	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe	88
PID 1900 wrote to memory of 3132	1900	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe	88
PID 1900 wrote to memory of 3132	1900	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe	88
PID 1900 wrote to memory of 3120	1900	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe	89
PID 1900 wrote to memory of 3120	1900	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe	89
PID 1900 wrote to memory of 3120	1900	6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe	89

C:\Users\Admin\AppData\Local\Temp\6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe
"C:\Users\Admin\AppData\Local\Temp\6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe"
1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
  2⤵
  PID:1072
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
  2⤵
  PID:4804
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  PID:3032
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
  2⤵
  PID:3116
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
  2⤵
  PID:3228
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat
  2⤵
  PID:3132
- C:\Users\Admin\AppData\Local\Temp\6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe
  "C:\Users\Admin\AppData\Local\Temp\6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe" -agent 0
  2⤵
  - Drops file in Program Files directory
  PID:3120

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1072-132-0x0000000000000000-mapping.dmp

Download
memory/3032-134-0x0000000000000000-mapping.dmp

Download
memory/3116-135-0x0000000000000000-mapping.dmp

Download
memory/3120-138-0x0000000000000000-mapping.dmp

Download
memory/3132-137-0x0000000000000000-mapping.dmp

Download
memory/3228-136-0x0000000000000000-mapping.dmp

Download
memory/4804-133-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads