Analysis
-
max time kernel
28s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
12/07/2023, 00:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe
Resource
win7-20230703-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe
-
Size
4.0MB
-
MD5
4f3c54dce019cb644bd43808be68799f
-
SHA1
95d459d269e3ea8d2153e25d551161b742772158
-
SHA256
9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945
-
SHA512
ae0b378c2ca68581960deb14f697b9cdc6996ee18a15d9fd79685d05fc98f6a7e287980f6d2a9391a803d052136fc61ac038ab4ad19be918c9ef7c6de4606321
-
SSDEEP
98304:iaDqFnt/A+ZCkZ51hRBh7TAmYHbot35NvDWMFFaeb:nOJSYPhX90mY7ot35ZDWMXaeb
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1496-54-0x0000000180000000-0x0000000180057000-memory.dmp upx behavioral1/memory/1496-58-0x0000000180000000-0x0000000180057000-memory.dmp upx behavioral1/memory/1496-57-0x0000000180000000-0x0000000180057000-memory.dmp upx behavioral1/memory/1496-59-0x0000000180000000-0x0000000180057000-memory.dmp upx behavioral1/memory/1496-60-0x0000000180000000-0x0000000180057000-memory.dmp upx behavioral1/memory/1496-61-0x0000000180000000-0x0000000180057000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe File opened (read-only) \??\E: 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe File opened (read-only) \??\S: 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe File opened (read-only) \??\U: 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe File opened (read-only) \??\M: 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe File opened (read-only) \??\R: 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe File opened (read-only) \??\T: 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe File opened (read-only) \??\W: 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe File opened (read-only) \??\Y: 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe File opened (read-only) \??\F: 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe File opened (read-only) \??\I: 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe File opened (read-only) \??\J: 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe File opened (read-only) \??\K: 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe File opened (read-only) \??\L: 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe File opened (read-only) \??\O: 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe File opened (read-only) \??\Q: 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe File opened (read-only) \??\V: 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe File opened (read-only) \??\Z: 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe File opened (read-only) \??\G: 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe File opened (read-only) \??\H: 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe File opened (read-only) \??\N: 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe File opened (read-only) \??\P: 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe File opened (read-only) \??\X: 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1496 9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe"C:\Users\Admin\AppData\Local\Temp\9e081e7ccf07299d648e27940bb332af170b152e1a91fc631e3c97357504d945.exe"1⤵
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1496