b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe
Size

646KB
MD5

10ba40760f898647791450b11662862c
SHA1

f04684dce6957ef5ea5a45f77b21b7af643fb321
SHA256

b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04
SHA512

265acafe249b199f67cc7f1ea7f5759c23e84ea50144a707c2d7d56028b522d50a64c3089a5a67cff83a554380af589b6a9fae9261b61885a2787e221a29e69c
SSDEEP

12288:2+1a8L1IuTlumEHXYBbFaanqBNakDYxKkN11t93pvqNZsH:b4I5ImOXYpQZ/7DA/d3pvis

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe:*:Enabled:b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04"	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\1 = "C:\\Windows\\system32\\ktc.exe"	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe

Disables Task Manager via registry modification
evasion

Enumerates connected drives 3 TTPs 7 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe
File opened (read-only)	\??\H:	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe
File opened (read-only)	\??\I:	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe
File opened (read-only)	\??\K:	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe
File opened (read-only)	\??\L:	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe
File opened (read-only)	\??\E:	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe
File opened (read-only)	\??\F:	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Autorun.inf	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe
File created	C:\Autorun.inf	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ktc.exe	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe
File opened for modification	C:\Windows\SysWOW64\ktc.exe	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3800	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe
3800	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe

C:\Users\Admin\AppData\Local\Temp\b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe
"C:\Users\Admin\AppData\Local\Temp\b759a6a6d52e540b376146d0cebbb58dab41516004b58909af9d761ed20adc04.exe"
1⤵
- Modifies firewall policy service
- Adds policy Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3800