7bf9d2c47481b170e965c4fd7848ff539103fc15b903fbd7a961e5a268ae1385

Analysis

max time kernel
151s
max time network
168s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ad58f44f09009a0b8162d359e090c03.exe
Size

16KB
MD5

1ad58f44f09009a0b8162d359e090c03
SHA1

6e8a18ecf77f711ca1c99b70536630c70eb3f8cf
SHA256

7bf9d2c47481b170e965c4fd7848ff539103fc15b903fbd7a961e5a268ae1385
SHA512

ef6de1014b04988915c8be5a51e6df306cdefd715045a5faa82c97de1156cb4606239fbda572bfdafd26331d4a0d83ec41bfc9a9fa484258f468872121bd3d5a
SSDEEP

192:t1raoNTaMQE15MD1F2LlJZCDqB5WiI4h1foSH9XNXonP0FaltCgqC18:t1OoNTyRFAlvCAWiI4hu0jmPGWC01

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	1ad58f44f09009a0b8162d359e090c03.exe
File opened (read-only)	\??\U:	1ad58f44f09009a0b8162d359e090c03.exe
File opened (read-only)	\??\Y:	1ad58f44f09009a0b8162d359e090c03.exe
File opened (read-only)	\??\Z:	1ad58f44f09009a0b8162d359e090c03.exe
File opened (read-only)	\??\I:	1ad58f44f09009a0b8162d359e090c03.exe
File opened (read-only)	\??\N:	1ad58f44f09009a0b8162d359e090c03.exe
File opened (read-only)	\??\P:	1ad58f44f09009a0b8162d359e090c03.exe
File opened (read-only)	\??\G:	1ad58f44f09009a0b8162d359e090c03.exe
File opened (read-only)	\??\K:	1ad58f44f09009a0b8162d359e090c03.exe
File opened (read-only)	\??\M:	1ad58f44f09009a0b8162d359e090c03.exe
File opened (read-only)	\??\T:	1ad58f44f09009a0b8162d359e090c03.exe
File opened (read-only)	\??\V:	1ad58f44f09009a0b8162d359e090c03.exe
File opened (read-only)	\??\W:	1ad58f44f09009a0b8162d359e090c03.exe
File opened (read-only)	\??\X:	1ad58f44f09009a0b8162d359e090c03.exe
File opened (read-only)	\??\H:	1ad58f44f09009a0b8162d359e090c03.exe
File opened (read-only)	\??\J:	1ad58f44f09009a0b8162d359e090c03.exe
File opened (read-only)	\??\L:	1ad58f44f09009a0b8162d359e090c03.exe
File opened (read-only)	\??\O:	1ad58f44f09009a0b8162d359e090c03.exe
File opened (read-only)	\??\Q:	1ad58f44f09009a0b8162d359e090c03.exe
File opened (read-only)	\??\R:	1ad58f44f09009a0b8162d359e090c03.exe
File opened (read-only)	\??\S:	1ad58f44f09009a0b8162d359e090c03.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Tasks\spoolsv.ext	1ad58f44f09009a0b8162d359e090c03.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2212	1ad58f44f09009a0b8162d359e090c03.exe
2212	1ad58f44f09009a0b8162d359e090c03.exe
2212	1ad58f44f09009a0b8162d359e090c03.exe
2212	1ad58f44f09009a0b8162d359e090c03.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2212	1ad58f44f09009a0b8162d359e090c03.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2212	1ad58f44f09009a0b8162d359e090c03.exe

C:\Users\Admin\AppData\Local\Temp\1ad58f44f09009a0b8162d359e090c03.exe
"C:\Users\Admin\AppData\Local\Temp\1ad58f44f09009a0b8162d359e090c03.exe"
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads