48987d9c89542a8cb4f8d34eb34902a4762cc8643c0e491deb6115907db4887b

Analysis

max time kernel
361s
max time network
366s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
30-07-2023 23:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setup_File.exe
Size

28.1MB
MD5

9ddc92ae27b3c01abcc9361f5f10dbeb
SHA1

4ae7273d55275c53ebd66fd8d55d54d5257ad21d
SHA256

48987d9c89542a8cb4f8d34eb34902a4762cc8643c0e491deb6115907db4887b
SHA512

20f81c7cf228b92ef488fc24d1a3ed288f77036903bfcb1a650a7505a9f618c2fafa09e4b7c5e539a5627d6436f7011f1ed0ecf027609524006c07716447e68b
SSDEEP

786432:z6FQ28LUo3oaouyd+sP6qSwbJ+IViZRR/5PwUA1:zAQPLUcoMA+sP6q3pV255rI

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

Setup_File.exe

description ioc process

File opened (read-only) \??\F: Setup_File.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

Setup_File.exe

pid process

2484 Setup_File.exe
2484 Setup_File.exe
2484 Setup_File.exe
2484 Setup_File.exe
2484 Setup_File.exe
2484 Setup_File.exe
2484 Setup_File.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Setup_File.exe

description pid process

Token: SeShutdownPrivilege 2484 Setup_File.exe

description	ioc	process
File opened (read-only)	\??\F:	Setup_File.exe

pid	process
2484	Setup_File.exe
2484	Setup_File.exe
2484	Setup_File.exe
2484	Setup_File.exe
2484	Setup_File.exe
2484	Setup_File.exe
2484	Setup_File.exe

description	pid	process
Token: SeShutdownPrivilege	2484	Setup_File.exe

C:\Users\Admin\AppData\Local\Temp\Setup_File.exe
"C:\Users\Admin\AppData\Local\Temp\Setup_File.exe"
1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2484

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2484-53-0x0000000077DE0000-0x0000000077DE2000-memory.dmp

Filesize
8KB

Download
memory/2484-55-0x0000000077DE0000-0x0000000077DE2000-memory.dmp

Filesize
8KB

Download
memory/2484-57-0x0000000077DE0000-0x0000000077DE2000-memory.dmp

Filesize
8KB

Download
memory/2484-58-0x0000000077DF0000-0x0000000077DF2000-memory.dmp

Filesize
8KB

Download
memory/2484-60-0x000000013F1F0000-0x0000000142029000-memory.dmp

Filesize
46.2MB

Download
memory/2484-61-0x0000000077DF0000-0x0000000077DF2000-memory.dmp

Filesize
8KB

Download
memory/2484-63-0x0000000077DF0000-0x0000000077DF2000-memory.dmp

Filesize
8KB

Download
memory/2484-65-0x0000000077C30000-0x0000000077DD9000-memory.dmp

Filesize
1.7MB

Download
memory/2484-64-0x0000000077E10000-0x0000000077E12000-memory.dmp

Filesize
8KB

Download
memory/2484-67-0x0000000077E10000-0x0000000077E12000-memory.dmp

Filesize
8KB

Download
memory/2484-69-0x0000000077E10000-0x0000000077E12000-memory.dmp

Filesize
8KB

Download
memory/2484-74-0x0000000077E20000-0x0000000077E22000-memory.dmp

Filesize
8KB

Download
memory/2484-72-0x0000000077E20000-0x0000000077E22000-memory.dmp

Filesize
8KB

Download
memory/2484-70-0x0000000077E20000-0x0000000077E22000-memory.dmp

Filesize
8KB

Download
memory/2484-79-0x0000000077E30000-0x0000000077E32000-memory.dmp

Filesize
8KB

Download
memory/2484-77-0x0000000077E30000-0x0000000077E32000-memory.dmp

Filesize
8KB

Download
memory/2484-75-0x0000000077E30000-0x0000000077E32000-memory.dmp

Filesize
8KB

Download
memory/2484-82-0x000007FEFDDD0000-0x000007FEFDDD2000-memory.dmp

Filesize
8KB

Download
memory/2484-84-0x000007FEFDDD0000-0x000007FEFDDD2000-memory.dmp

Filesize
8KB

Download
memory/2484-87-0x000007FEFDDE0000-0x000007FEFDDE2000-memory.dmp

Filesize
8KB

Download
memory/2484-89-0x000007FEFDDE0000-0x000007FEFDDE2000-memory.dmp

Filesize
8KB

Download
memory/2484-90-0x000000013F1F0000-0x0000000142029000-memory.dmp

Filesize
46.2MB

Download
memory/2484-96-0x000000013F1F0000-0x0000000142029000-memory.dmp

Filesize
46.2MB

Download
memory/2484-97-0x0000000077C30000-0x0000000077DD9000-memory.dmp

Filesize
1.7MB

Download
memory/2484-98-0x0000000077C30000-0x0000000077DD9000-memory.dmp

Filesize
1.7MB

Download
memory/2484-99-0x000000013F1F0000-0x0000000142029000-memory.dmp

Filesize
46.2MB

Download