49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 01:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514.exe
Size

150KB
MD5

43742b82feda4e7dcef1de2c860180c0
SHA1

2c9c88e21f91333c9f6bd56df477d51fb7c711b8
SHA256

49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514
SHA512

5cffb0c074e5ca448a812d65d4123034f7add82470849cfaaf9349be96b948fc9941f688cd19433928e1fc4bf2c692c779d1545577c79e7c5168ac3feb4cae60
SSDEEP

1536:n9LjydJsw/4kHyYGZ8m8R87HQRaslaCPpqE8sqpB1V8Z1hAKxaRkf+KpCz7Sb:n1joJsw/4qciRA6FpqE8pfIAKxtGhzub

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\WOW6432Node\Microsoft\Windows\CurrentVersion\run	49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514.exe
File opened (read-only)	\??\G:	49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514.exe
File opened (read-only)	\??\Y:	49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514.exe
File opened (read-only)	\??\V:	49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514.exe
File opened (read-only)	\??\T:	49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514.exe
File opened (read-only)	\??\R:	49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514.exe
File opened (read-only)	\??\O:	49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514.exe
File opened (read-only)	\??\H:	49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514.exe
File opened (read-only)	\??\F:	49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514.exe
File opened (read-only)	\??\Z:	49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514.exe
File opened (read-only)	\??\X:	49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514.exe
File opened (read-only)	\??\U:	49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514.exe
File opened (read-only)	\??\M:	49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514.exe
File opened (read-only)	\??\J:	49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514.exe
File opened (read-only)	\??\W:	49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514.exe
File opened (read-only)	\??\Q:	49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514.exe
File opened (read-only)	\??\P:	49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514.exe
File opened (read-only)	\??\N:	49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514.exe
File opened (read-only)	\??\S:	49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514.exe
File opened (read-only)	\??\L:	49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514.exe
File opened (read-only)	\??\I:	49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514.exe
File opened (read-only)	\??\E:	49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514.exe
File opened for modification	C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\CD Burning\autorun.inf	49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4836	49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514.exe
4836	49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514.exe

C:\Users\Admin\AppData\Local\Temp\49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514.exe
"C:\Users\Admin\AppData\Local\Temp\49533efe0bc0114c4b39ba834b3b2323f81ffc9fbd149abcbfdf98affa70c514.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
PID:4836