b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04

General

Target

b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe
Size

646KB
MD5

10ba40760f898647791450b11662862c
SHA1

f04684dce6957ef5ea5a45f77b21b7af643fb321
SHA256

b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04
SHA512

265acafe249b199f67cc7f1ea7f5759c23e84ea50144a707c2d7d56028b522d50a64c3089a5a67cff83a554380af589b6a9fae9261b61885a2787e221a29e69c
SSDEEP

12288:2+1a8L1IuTlumEHXYBbFaanqBNakDYxKkN11t93pvqNZsH:b4I5ImOXYpQZ/7DA/d3pvis

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe:*:Enabled:b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04"	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\1 = "C:\\Windows\\system32\\ktc.exe"	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe

Disables Task Manager via registry modification
evasion

Enumerates connected drives 3 TTPs 7 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe
File opened (read-only)	\??\E:	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe
File opened (read-only)	\??\F:	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe
File opened (read-only)	\??\G:	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe
File opened (read-only)	\??\H:	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe
File opened (read-only)	\??\I:	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe
File opened (read-only)	\??\K:	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Autorun.inf	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe
File created	C:\Autorun.inf	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ktc.exe	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe
File opened for modification	C:\Windows\SysWOW64\ktc.exe	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1600	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe
1600	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe

C:\Users\Admin\AppData\Local\Temp\b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe
"C:\Users\Admin\AppData\Local\Temp\b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe"
1⤵
- Modifies firewall policy service
- Adds policy Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1600