ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e

Analysis

max time kernel
153s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2023, 19:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
Size

26KB
MD5

cab628bceb8b3c9bb2b79a71a0d68319
SHA1

a20587dd81165b8e1e22b056c40677d94bece6cb
SHA256

ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e
SHA512

d71b4eea641bec4c2d86d55702f6d96eca1af92ca4ab87b24fc3eeab2b705134629ef80b9f5d1cb29c5212b0866d39963708851bd39e1f6774198a6e7df2af78
SSDEEP

768:1Z1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoGwXnKx:tfgLdQAQfcfymNG+Kx

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened (read-only)	\??\Q:	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened (read-only)	\??\K:	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened (read-only)	\??\J:	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened (read-only)	\??\I:	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened (read-only)	\??\S:	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened (read-only)	\??\N:	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened (read-only)	\??\L:	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened (read-only)	\??\H:	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened (read-only)	\??\G:	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened (read-only)	\??\Z:	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened (read-only)	\??\W:	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened (read-only)	\??\U:	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened (read-only)	\??\T:	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened (read-only)	\??\M:	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened (read-only)	\??\E:	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened (read-only)	\??\Y:	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened (read-only)	\??\X:	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened (read-only)	\??\V:	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened (read-only)	\??\P:	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened (read-only)	\??\O:	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe

Drops file in Program Files directory 53 IoCs

description	ioc	Process
File created	C:\Program Files\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\Google\Chrome\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File created	C:\Program Files\Java\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File created	C:\Program Files\Google\Chrome\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File created	C:\Program Files\Java\jdk1.8.0_66\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\Java\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\Google\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\7-Zip\Lang\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\7-Zip\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File created	C:\Program Files\Google\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File created	C:\Program Files\7-Zip\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File created	C:\Program Files\Google\Chrome\Application\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File created	C:\Program Files\7-Zip\Lang\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File created	C:\Program Files\Java\jdk1.8.0_66\bin\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\_desktop.ini	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3236	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
3236	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
3236	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
3236	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
3236	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
3236	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
3236	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
3236	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
3236	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
3236	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
3236	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
3236	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
3236	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
3236	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
3236	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
3236	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
3236	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
3236	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
3236	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
3236	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 1912	3236	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe	84
PID 3236 wrote to memory of 1912	3236	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe	84
PID 3236 wrote to memory of 1912	3236	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe	84
PID 1912 wrote to memory of 1808	1912	net.exe	86
PID 1912 wrote to memory of 1808	1912	net.exe	86
PID 1912 wrote to memory of 1808	1912	net.exe	86
PID 3236 wrote to memory of 2812	3236	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe	53
PID 3236 wrote to memory of 2812	3236	ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe	53

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2812
- C:\Users\Admin\AppData\Local\Temp\ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
  "C:\Users\Admin\AppData\Local\Temp\ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1912
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:1808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
2.8MB

MD5
a2a48363162d1b1a1163bb6067c1913c

SHA1
52cac85e0d046325a601ab194335eef55b2ffb1b

SHA256
cb93b8234901d93d048515c5abe8a56e931653e0f7aa13e7eed6a4b579333490

SHA512
a4fea1ff27926fc83fc09c77d82a7ace4fee1d5f3e38d16ea581fb0aa5e698045ec47fa5c78f7dba2785ead50d4a1c4a811a9ad6940bdadf856365681a88a59f

Download Submit
C:\odt\_desktop.ini

Filesize
9B

MD5
872506f1dadcc0cedd1e9dee11f54da4

SHA1
d1e87145ed1d918f10ae4e93ccdbb994bc906ed5

SHA256
a0049e98811438481e150df54f7b555026746c943cb03106677bf75b4e412104

SHA512
6cf3aeeed18e66a16ed653a5c33133ec8d5fb58cf42aab9e712cf473233e506d4f14692dff04b7c20847718e5c344ec2651e57d2ae7a034610b07679b786344c

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-1045988481-1457812719-2617974652-1000\_desktop.ini

Filesize
9B

MD5
0d8cc6d8ad77008e4eea5193ba074b8b

SHA1
ed3ef3737662f0b0d7dabb8a681fdab8882322a1

SHA256
02cb6e1ee5bc2475b62b35df1ff95d9d38080ea818c3fea2c65ceb449c761999

SHA512
8cf0f361865203a0b8ea23fb3a33827b86958c4035294db074562956d6fe213d9069f3e5687ea66284e14f4406d74d348d98eec1af10b2538acd7a302752813f

Download Submit
memory/3236-13-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3236-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3236-19-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3236-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3236-24-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3236-28-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3236-34-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3236-5-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3236-51-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3236-75-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3236-84-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download