Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
06-12-2022 00:09
General
-
Target
e4cf2cb5adba7561d7203bac0a88dd10a7ecd931693247c772dffb7cff36adcc.exe
-
Size
240KB
-
MD5
028e3bf939a0534b6c11f74f67164c98
-
SHA1
b98aa9f25cddf114252dd353ae56bb58db30cb9a
-
SHA256
e4cf2cb5adba7561d7203bac0a88dd10a7ecd931693247c772dffb7cff36adcc
-
SHA512
c1dae1c04a5d5661a4eb14496a5a44d71dd6a7f4190c8ee792fa0d4a291bfd68187afd9a50b2773a28520c1371647413075a2f35a1ca2508b7fcbf27736f1a92
-
SSDEEP
6144:7PeyxTM94W+HBuA2hNE8x7KLm6NNZkDwWfPMoRjTpzP:7PbZMRtKYwW/TpP
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4cf2cb5adba7561d7203bac0a88dd10a7ecd931693247c772dffb7cff36adcc.exe"C:\Users\Admin\AppData\Local\Temp\e4cf2cb5adba7561d7203bac0a88dd10a7ecd931693247c772dffb7cff36adcc.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Documents and Settings\tazebama.dl_"C:\Documents and Settings\tazebama.dl_"2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151KB
MD50b3665bb7e8f3f573d07f19042614bd2
SHA1b360a696d2a3c0f28d510a3056aba2c3f2347aa2
SHA256cb60609d667f512e596ceaa083a83915b54763de168a5b3fc7996ddb88dfa4d4
SHA512a35460faeb45988dcff18fe5609051f27d11c1304dcd845d137768589180fb6ac80c847e101d3508f485e939b1fb7c549daf9a4b777ec2ddb8c97c8336c092d1
-
Filesize
151KB
MD50b3665bb7e8f3f573d07f19042614bd2
SHA1b360a696d2a3c0f28d510a3056aba2c3f2347aa2
SHA256cb60609d667f512e596ceaa083a83915b54763de168a5b3fc7996ddb88dfa4d4
SHA512a35460faeb45988dcff18fe5609051f27d11c1304dcd845d137768589180fb6ac80c847e101d3508f485e939b1fb7c549daf9a4b777ec2ddb8c97c8336c092d1
-
Filesize
151KB
MD50b3665bb7e8f3f573d07f19042614bd2
SHA1b360a696d2a3c0f28d510a3056aba2c3f2347aa2
SHA256cb60609d667f512e596ceaa083a83915b54763de168a5b3fc7996ddb88dfa4d4
SHA512a35460faeb45988dcff18fe5609051f27d11c1304dcd845d137768589180fb6ac80c847e101d3508f485e939b1fb7c549daf9a4b777ec2ddb8c97c8336c092d1
-
Filesize
151KB
MD50b3665bb7e8f3f573d07f19042614bd2
SHA1b360a696d2a3c0f28d510a3056aba2c3f2347aa2
SHA256cb60609d667f512e596ceaa083a83915b54763de168a5b3fc7996ddb88dfa4d4
SHA512a35460faeb45988dcff18fe5609051f27d11c1304dcd845d137768589180fb6ac80c847e101d3508f485e939b1fb7c549daf9a4b777ec2ddb8c97c8336c092d1
-
Filesize
32KB
MD5b6a03576e595afacb37ada2f1d5a0529
SHA1d598d4d0e70dec2ffa2849edaeb4db94fedcc0b8
SHA2561707eaf60aa91f3791aa5643bfa038e9d8141878d61f5d701ebac51f4ae7aaad
SHA512181b7cc6479352fe2c53c3630d45a839cdeb74708be6709c2a75847a54de3ffc1fdac8450270dde7174ecb23e5cb002f8ce39032429a3112b1202f3381b8918c
-
Filesize
88KB
-
Filesize
8KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
88KB