e437070a0967082ce51e214dd421229c03ee506ef725c6cafe3f237bb0d4b070

Analysis

max time kernel
0s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 12:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e6e77f2bec238aa5b5c5cf1dca01722.exe
Size

84KB
MD5

1e6e77f2bec238aa5b5c5cf1dca01722
SHA1

96c63f660911ed9783ca1a799fb491e214e412cb
SHA256

e437070a0967082ce51e214dd421229c03ee506ef725c6cafe3f237bb0d4b070
SHA512

c83306b956bbb5b3fd9e818541e28d540b94a69e45a7924b8766c2bd668f6a04f13a18f3bed1df517255e833dacd8c2dd6e4bd1a0ff489a686d925c56b2fa63c
SSDEEP

1536:9Ivip5SWCRGx00hNpnnF0H6nmHnzUnBtuOy1scTFP8ecjNTw1mBVcL:9IvirSDGxBNpnFa6nQnonruOqsccjN09

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\N:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\Y:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\A:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\B:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\H:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\I:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\M:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\P:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\T:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\X:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\Z:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\E:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\J:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\O:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\Q:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\S:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\W:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\G:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\L:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\R:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\U:	1e6e77f2bec238aa5b5c5cf1dca01722.exe
File opened (read-only)	\??\V:	1e6e77f2bec238aa5b5c5cf1dca01722.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3560	1e6e77f2bec238aa5b5c5cf1dca01722.exe
Token: SeCreatePagefilePrivilege	3560	1e6e77f2bec238aa5b5c5cf1dca01722.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3560	1e6e77f2bec238aa5b5c5cf1dca01722.exe

C:\Users\Admin\AppData\Local\Temp\1e6e77f2bec238aa5b5c5cf1dca01722.exe
"C:\Users\Admin\AppData\Local\Temp\1e6e77f2bec238aa5b5c5cf1dca01722.exe"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
896KB

MD5
85545ea655efc8f39968b498311cbe1b

SHA1
b370355683104e337cad8822161bbad9e3b517bc

SHA256
a50845acc86d663a97fdef2d24b1262d352c74ad5fbe6ef2c8fa6d81e74bf358

SHA512
23824e8df50a70fc3ba462c5b4f56ed34fdda769129a4b1d54974610954686f89be213cc979961b2db40cbb1c2d20036a9bc33ae1976396ce9b799c85c40ebe8

Download Submit