ddd68b63fdc080a7b7fdf5432244f38c1bc2f5e1718c402973b19caec20b4eb6

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 08:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13296d86c33afc6419a1745195e1d17b.exe
Size

76KB
MD5

13296d86c33afc6419a1745195e1d17b
SHA1

69f68bd20af42782d87a4d8bc3254e3001cf2fb7
SHA256

ddd68b63fdc080a7b7fdf5432244f38c1bc2f5e1718c402973b19caec20b4eb6
SHA512

46f4e1ebae9b9b6e1032eb95a5cd4b47bc0737c73c31a32e99e3093f802440be9d4c66be241112eac68a3f3fe5a9406a263c8ddcfc269f00d0dc0dd60713c14c
SSDEEP

1536:Q3vYDbVnfSKEr08JuWYCso7jpP16s7R6QI:Q3qbJrEhg6vmtd

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	13296d86c33afc6419a1745195e1d17b.exe
File opened (read-only)	\??\A:	13296d86c33afc6419a1745195e1d17b.exe
File opened (read-only)	\??\O:	13296d86c33afc6419a1745195e1d17b.exe
File opened (read-only)	\??\R:	13296d86c33afc6419a1745195e1d17b.exe
File opened (read-only)	\??\S:	13296d86c33afc6419a1745195e1d17b.exe
File opened (read-only)	\??\X:	13296d86c33afc6419a1745195e1d17b.exe
File opened (read-only)	\??\J:	13296d86c33afc6419a1745195e1d17b.exe
File opened (read-only)	\??\K:	13296d86c33afc6419a1745195e1d17b.exe
File opened (read-only)	\??\N:	13296d86c33afc6419a1745195e1d17b.exe
File opened (read-only)	\??\W:	13296d86c33afc6419a1745195e1d17b.exe
File opened (read-only)	\??\Z:	13296d86c33afc6419a1745195e1d17b.exe
File opened (read-only)	\??\E:	13296d86c33afc6419a1745195e1d17b.exe
File opened (read-only)	\??\Q:	13296d86c33afc6419a1745195e1d17b.exe
File opened (read-only)	\??\T:	13296d86c33afc6419a1745195e1d17b.exe
File opened (read-only)	\??\U:	13296d86c33afc6419a1745195e1d17b.exe
File opened (read-only)	\??\V:	13296d86c33afc6419a1745195e1d17b.exe
File opened (read-only)	\??\M:	13296d86c33afc6419a1745195e1d17b.exe
File opened (read-only)	\??\P:	13296d86c33afc6419a1745195e1d17b.exe
File opened (read-only)	\??\B:	13296d86c33afc6419a1745195e1d17b.exe
File opened (read-only)	\??\G:	13296d86c33afc6419a1745195e1d17b.exe
File opened (read-only)	\??\H:	13296d86c33afc6419a1745195e1d17b.exe
File opened (read-only)	\??\I:	13296d86c33afc6419a1745195e1d17b.exe
File opened (read-only)	\??\L:	13296d86c33afc6419a1745195e1d17b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3176	13296d86c33afc6419a1745195e1d17b.exe
Token: SeCreatePagefilePrivilege	3176	13296d86c33afc6419a1745195e1d17b.exe
Token: SeShutdownPrivilege	3176	13296d86c33afc6419a1745195e1d17b.exe
Token: SeCreatePagefilePrivilege	3176	13296d86c33afc6419a1745195e1d17b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3176	13296d86c33afc6419a1745195e1d17b.exe

C:\Users\Admin\AppData\Local\Temp\13296d86c33afc6419a1745195e1d17b.exe
"C:\Users\Admin\AppData\Local\Temp\13296d86c33afc6419a1745195e1d17b.exe"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
401KB

MD5
2b2a0bb442a4ff26c5661a3b35764dc8

SHA1
ba9a0ccc4bb7ddd37e1797f4139776c6907750e8

SHA256
f3b96df7a9bfc93dde841a3189e7e9a43dfee5b033c7476df1005881734face7

SHA512
a3707d8841e948b5571738ca3354d71566b7a8f214b58accb6561b01461ca8d4dc22dcf9f46196ab5828c00656e3e381922be73329cc378313f3527eabf8a338

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit