0579298ad7445a984b63b725449e2b2094209abd32e61b2fd2cd931c2ce502dc

General

Target

3fd2b5d5ceebd227fd02f98554dcb1e8.exe
Size

770KB
MD5

3fd2b5d5ceebd227fd02f98554dcb1e8
SHA1

2051fad3b05fce8609a941b39cbd9d6f98e2d043
SHA256

0579298ad7445a984b63b725449e2b2094209abd32e61b2fd2cd931c2ce502dc
SHA512

7a73a607a9b11fac10dfd500f233f034cc943a92f4434bf8a6af6f69e657cae4056aec32c88325aa2fcbe3f88923f6da0c846712491c950e7e03191f8a1088ae
SSDEEP

12288:2JtD9OnGtdb+yvfUVs+YntBqNFpP1ODmU2NJ0/tH3cFkdUnaIQYGCWYbsRnNIX:AxOoxhUO+YnPmFx1OIy6FkgCCVqnN+

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
File opened (read-only)	\??\U:	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
File opened (read-only)	\??\V:	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
File opened (read-only)	\??\E:	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
File opened (read-only)	\??\I:	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
File opened (read-only)	\??\J:	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
File opened (read-only)	\??\L:	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
File opened (read-only)	\??\R:	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
File opened (read-only)	\??\W:	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
File opened (read-only)	\??\G:	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
File opened (read-only)	\??\H:	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
File opened (read-only)	\??\K:	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
File opened (read-only)	\??\P:	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
File opened (read-only)	\??\Y:	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
File opened (read-only)	\??\Z:	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
File opened (read-only)	\??\M:	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
File opened (read-only)	\??\O:	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
File opened (read-only)	\??\Q:	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
File opened (read-only)	\??\X:	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
File opened (read-only)	\??\S:	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
File opened (read-only)	\??\T:	3fd2b5d5ceebd227fd02f98554dcb1e8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 25 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4a003100000000009a574bb0102054656d700000360008000400efbe8f579b7b9a574bb02a000000fd010000000002000000000000000000000000000000540065006d007000000014000000	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 7e0074001c004346534616003100000000008f579b7b122041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f3c0008000400efbe8f579b7b8f579b7b2a000000e90100000000020000000000000000000000000000004100700070004400610074006100000042000000	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 4c003100000000008f57927d10204c6f63616c00380008000400efbe8f579b7b8f57927d2a000000fc0100000000020000000000000000000000000000004c006f00630061006c00000014000000	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_Classes\Local Settings	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	3fd2b5d5ceebd227fd02f98554dcb1e8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	3fd2b5d5ceebd227fd02f98554dcb1e8.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2092	3fd2b5d5ceebd227fd02f98554dcb1e8.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2092	3fd2b5d5ceebd227fd02f98554dcb1e8.exe

C:\Users\Admin\AppData\Local\Temp\3fd2b5d5ceebd227fd02f98554dcb1e8.exe
"C:\Users\Admin\AppData\Local\Temp\3fd2b5d5ceebd227fd02f98554dcb1e8.exe"
1⤵
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2092-0-0x0000000000400000-0x00000000005F6000-memory.dmp

Filesize
2.0MB

Download
memory/2092-1-0x0000000000400000-0x00000000005F6000-memory.dmp

Filesize
2.0MB

Download
memory/2092-3-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2092-4-0x0000000004020000-0x0000000004022000-memory.dmp

Filesize
8KB

Download
memory/2092-5-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing