525a2eb43f2a4c702213723541335dc0391b42a01177e1faf5873e0cb7540ce0

General

Target

HTTP-1689585819.498956-044cc568b52ce2e65eb82d3d3b7ffa2f-FgrQ8d4Z1BTy0diuK7.exe
Size

633KB
MD5

044cc568b52ce2e65eb82d3d3b7ffa2f
SHA1

e53df45b9994f7d02b48b0e002d5e06f00535bc6
SHA256

525a2eb43f2a4c702213723541335dc0391b42a01177e1faf5873e0cb7540ce0
SHA512

1ee71ba4ba71faf0f1bc4fc4b3f5292ffef6cfa19d08b169534260daaf2bf99960db364382039f45fb17e44295d9c2473a747779a21cb35375666c08af3ed4be
SSDEEP

12288:slKyxovP4Jw+ULNC0IVfG5IAeKPOFwTM84qpcy+qtv2tSoTqLQby4q:sMyavP4Jhg7IWWFA4qphN28o+LQe4q

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 7 IoCs

Processes:

HTTP-1689585819.498956-044cc568b52ce2e65eb82d3d3b7ffa2f-FgrQ8d4Z1BTy0diuK7.exe

pid	process
2488	HTTP-1689585819.498956-044cc568b52ce2e65eb82d3d3b7ffa2f-FgrQ8d4Z1BTy0diuK7.exe
2488	HTTP-1689585819.498956-044cc568b52ce2e65eb82d3d3b7ffa2f-FgrQ8d4Z1BTy0diuK7.exe
2488	HTTP-1689585819.498956-044cc568b52ce2e65eb82d3d3b7ffa2f-FgrQ8d4Z1BTy0diuK7.exe
1284
1284
1284
1284

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 5 IoCs

Processes:

HTTP-1689585819.498956-044cc568b52ce2e65eb82d3d3b7ffa2f-FgrQ8d4Z1BTy0diuK7.exe

description	ioc	process
File created	C:\Program Files\Tftpd64\tftpd64.exe	HTTP-1689585819.498956-044cc568b52ce2e65eb82d3d3b7ffa2f-FgrQ8d4Z1BTy0diuK7.exe
File created	C:\Program Files\Tftpd64\tftpd32.chm	HTTP-1689585819.498956-044cc568b52ce2e65eb82d3d3b7ffa2f-FgrQ8d4Z1BTy0diuK7.exe
File created	C:\Program Files\Tftpd64\EUPL-EN.pdf	HTTP-1689585819.498956-044cc568b52ce2e65eb82d3d3b7ffa2f-FgrQ8d4Z1BTy0diuK7.exe
File created	C:\Program Files\Tftpd64\tftpd32.ini	HTTP-1689585819.498956-044cc568b52ce2e65eb82d3d3b7ffa2f-FgrQ8d4Z1BTy0diuK7.exe
File created	C:\Program Files\Tftpd64\uninstall.exe	HTTP-1689585819.498956-044cc568b52ce2e65eb82d3d3b7ffa2f-FgrQ8d4Z1BTy0diuK7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
\Program Files\Tftpd64\uninstall.exe	nsis_installer_1
\Program Files\Tftpd64\uninstall.exe	nsis_installer_2

C:\Users\Admin\AppData\Local\Temp\HTTP-1689585819.498956-044cc568b52ce2e65eb82d3d3b7ffa2f-FgrQ8d4Z1BTy0diuK7.exe
"C:\Users\Admin\AppData\Local\Temp\HTTP-1689585819.498956-044cc568b52ce2e65eb82d3d3b7ffa2f-FgrQ8d4Z1BTy0diuK7.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
PID:2488

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Tftpd64\tftpd64.exe
Filesize
383KB

MD5
3c1e3215acc69f06f044802ed4695333

SHA1
ea34a6bad04bc5a1fcb494668347cd302557f327

SHA256
34de53b43c32e3ed5231a57683103acad1aebeef08309cf8e770c27acc90e4e7

SHA512
82ed2edbb7286aac00b946f7f4c79e59079994fe8385e961abd1291440fdf26e14c724943eaabebb517e921ece4b384b9d50905898d71f2efaa427be7082d2d0

Download Submit
\Program Files\Tftpd64\tftpd64.exe
Filesize
383KB

MD5
3c1e3215acc69f06f044802ed4695333

SHA1
ea34a6bad04bc5a1fcb494668347cd302557f327

SHA256
34de53b43c32e3ed5231a57683103acad1aebeef08309cf8e770c27acc90e4e7

SHA512
82ed2edbb7286aac00b946f7f4c79e59079994fe8385e961abd1291440fdf26e14c724943eaabebb517e921ece4b384b9d50905898d71f2efaa427be7082d2d0

Download Submit
\Program Files\Tftpd64\tftpd64.exe
Filesize
383KB

MD5
3c1e3215acc69f06f044802ed4695333

SHA1
ea34a6bad04bc5a1fcb494668347cd302557f327

SHA256
34de53b43c32e3ed5231a57683103acad1aebeef08309cf8e770c27acc90e4e7

SHA512
82ed2edbb7286aac00b946f7f4c79e59079994fe8385e961abd1291440fdf26e14c724943eaabebb517e921ece4b384b9d50905898d71f2efaa427be7082d2d0

Download Submit
\Program Files\Tftpd64\tftpd64.exe
Filesize
383KB

MD5
3c1e3215acc69f06f044802ed4695333

SHA1
ea34a6bad04bc5a1fcb494668347cd302557f327

SHA256
34de53b43c32e3ed5231a57683103acad1aebeef08309cf8e770c27acc90e4e7

SHA512
82ed2edbb7286aac00b946f7f4c79e59079994fe8385e961abd1291440fdf26e14c724943eaabebb517e921ece4b384b9d50905898d71f2efaa427be7082d2d0

Download Submit
\Program Files\Tftpd64\tftpd64.exe
Filesize
383KB

MD5
3c1e3215acc69f06f044802ed4695333

SHA1
ea34a6bad04bc5a1fcb494668347cd302557f327

SHA256
34de53b43c32e3ed5231a57683103acad1aebeef08309cf8e770c27acc90e4e7

SHA512
82ed2edbb7286aac00b946f7f4c79e59079994fe8385e961abd1291440fdf26e14c724943eaabebb517e921ece4b384b9d50905898d71f2efaa427be7082d2d0

Download Submit
\Program Files\Tftpd64\tftpd64.exe
Filesize
383KB

MD5
3c1e3215acc69f06f044802ed4695333

SHA1
ea34a6bad04bc5a1fcb494668347cd302557f327

SHA256
34de53b43c32e3ed5231a57683103acad1aebeef08309cf8e770c27acc90e4e7

SHA512
82ed2edbb7286aac00b946f7f4c79e59079994fe8385e961abd1291440fdf26e14c724943eaabebb517e921ece4b384b9d50905898d71f2efaa427be7082d2d0

Download Submit
\Program Files\Tftpd64\tftpd64.exe
Filesize
383KB

MD5
3c1e3215acc69f06f044802ed4695333

SHA1
ea34a6bad04bc5a1fcb494668347cd302557f327

SHA256
34de53b43c32e3ed5231a57683103acad1aebeef08309cf8e770c27acc90e4e7

SHA512
82ed2edbb7286aac00b946f7f4c79e59079994fe8385e961abd1291440fdf26e14c724943eaabebb517e921ece4b384b9d50905898d71f2efaa427be7082d2d0

Download Submit
\Program Files\Tftpd64\uninstall.exe
Filesize
37KB

MD5
078daf9669ef12a368f1aed5a21b1cd1

SHA1
fc4d9a58d42089d6e7c42f45b92d87f978958dea

SHA256
0a91e2fab1de979c8bd0816c5a709deb7bdb80a198c9163d58a5ce377607fb9d

SHA512
7a18dcf41e30278cc1348c51ad904f9024dd431c48faa576484f8b189e53bccffade0a94563d0bf76fb07a0cbdc6033dec95ec8f1ad59c32518967b8d59df30d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads