9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee

General

Target

9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe
Size

549KB
MD5

299f72f43835e7354683fb37e8c3cbe2
SHA1

6cb67b0ab81fbe5da6913ceb5e34067d8836c22b
SHA256

9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee
SHA512

813717c80575c4ade713481a290fce863ab81a0d8ba9af1ac1c846ecff267704ae72b2ebc1de6825226a630d6f8e00c1f1f3fcbbb17290673bfcc7bb717ed10c
SSDEEP

12288:RJBZ+mhKYgGpThpmGVF6VpnExhwr5GwLPYq8bm+4Esk0:RNhKYlR/VMVFChwr5jGy+/sk0

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 944 set thread context of 1760	944	9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
944	9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 1760	944	9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe	27
PID 944 wrote to memory of 1760	944	9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe	27
PID 944 wrote to memory of 1760	944	9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe	27
PID 944 wrote to memory of 1760	944	9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe	27
PID 944 wrote to memory of 1760	944	9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe	27
PID 944 wrote to memory of 1760	944	9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe	27
PID 944 wrote to memory of 1760	944	9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe	27
PID 944 wrote to memory of 1760	944	9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe	27
PID 944 wrote to memory of 1760	944	9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe	27
PID 944 wrote to memory of 1760	944	9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe	27
PID 944 wrote to memory of 1760	944	9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe	27
PID 944 wrote to memory of 1760	944	9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe	27
PID 944 wrote to memory of 1760	944	9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe	27

C:\Users\Admin\AppData\Local\Temp\9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe
"C:\Users\Admin\AppData\Local\Temp\9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe"
1⤵
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:944
- C:\Users\Admin\AppData\Local\Temp\9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe
  C:\Users\Admin\AppData\Local\Temp\9a40e3096ed27fb4089941493d74e80d00e1af78f4812a4b8cbb847076b8f9ee.exe
  2⤵
  PID:1760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/944-54-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/1760-57-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1760-58-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1760-60-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1760-61-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1760-62-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1760-64-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1760-68-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1760-70-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1760-72-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1760-74-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1760-76-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1760-78-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1760-80-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1760-82-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1760-84-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1760-86-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1760-88-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1760-90-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1760-92-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1760-94-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1760-96-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1760-97-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing