532c9b4d1c02390d151b187039cb5941a7174354c1a67258bc6ad54b39b8a94e

General

Target

4550af4d492c318004c861fc89302b2f.exe
Size

1.0MB
MD5

4550af4d492c318004c861fc89302b2f
SHA1

e32bbae966904e8fea8b280d121b6922fc316b9f
SHA256

532c9b4d1c02390d151b187039cb5941a7174354c1a67258bc6ad54b39b8a94e
SHA512

1556548cafc9d24ddd0ecf57ce5675c722959df16c00aca78f293c383cb81ffc4bd050f58c6e2a36368c056169bc527b3c3d18fa71b24337cbeaaa2069014768
SSDEEP

24576:frX4bIIKCmtNee4XsihjMwwUWbqzjyBtFWTNPMfpt:DpN5e4ihjMQWWzjcl

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	4550af4d492c318004c861fc89302b2f.exe
File opened (read-only)	\??\K:	4550af4d492c318004c861fc89302b2f.exe
File opened (read-only)	\??\O:	4550af4d492c318004c861fc89302b2f.exe
File opened (read-only)	\??\W:	4550af4d492c318004c861fc89302b2f.exe
File opened (read-only)	\??\X:	4550af4d492c318004c861fc89302b2f.exe
File opened (read-only)	\??\P:	4550af4d492c318004c861fc89302b2f.exe
File opened (read-only)	\??\A:	4550af4d492c318004c861fc89302b2f.exe
File opened (read-only)	\??\B:	4550af4d492c318004c861fc89302b2f.exe
File opened (read-only)	\??\G:	4550af4d492c318004c861fc89302b2f.exe
File opened (read-only)	\??\J:	4550af4d492c318004c861fc89302b2f.exe
File opened (read-only)	\??\L:	4550af4d492c318004c861fc89302b2f.exe
File opened (read-only)	\??\M:	4550af4d492c318004c861fc89302b2f.exe
File opened (read-only)	\??\I:	4550af4d492c318004c861fc89302b2f.exe
File opened (read-only)	\??\Q:	4550af4d492c318004c861fc89302b2f.exe
File opened (read-only)	\??\R:	4550af4d492c318004c861fc89302b2f.exe
File opened (read-only)	\??\V:	4550af4d492c318004c861fc89302b2f.exe
File opened (read-only)	\??\Z:	4550af4d492c318004c861fc89302b2f.exe
File opened (read-only)	\??\E:	4550af4d492c318004c861fc89302b2f.exe
File opened (read-only)	\??\N:	4550af4d492c318004c861fc89302b2f.exe
File opened (read-only)	\??\S:	4550af4d492c318004c861fc89302b2f.exe
File opened (read-only)	\??\T:	4550af4d492c318004c861fc89302b2f.exe
File opened (read-only)	\??\U:	4550af4d492c318004c861fc89302b2f.exe
File opened (read-only)	\??\Y:	4550af4d492c318004c861fc89302b2f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1712	2984	WerFault.exe	14

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashFXP_PIcon	4550af4d492c318004c861fc89302b2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashFXP_PIcon\ = "FlashFXP ÉÏ²ãÎÄ¼þ¼ÐÍ¼±ê"	4550af4d492c318004c861fc89302b2f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashFXP_PIcon\DefaultIcon	4550af4d492c318004c861fc89302b2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashFXP_PIcon\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4550af4d492c318004c861fc89302b2f.exe,1"	4550af4d492c318004c861fc89302b2f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	4550af4d492c318004c861fc89302b2f.exe
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	4550af4d492c318004c861fc89302b2f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.FlashFXP_PIcon	4550af4d492c318004c861fc89302b2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.FlashFXP_PIcon\ = "FlashFXP_PIcon"	4550af4d492c318004c861fc89302b2f.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2984	4550af4d492c318004c861fc89302b2f.exe
2984	4550af4d492c318004c861fc89302b2f.exe

C:\Users\Admin\AppData\Local\Temp\4550af4d492c318004c861fc89302b2f.exe
"C:\Users\Admin\AppData\Local\Temp\4550af4d492c318004c861fc89302b2f.exe"
1⤵
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 528
  2⤵
  - Program crash
  PID:1712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2984 -ip 2984
1⤵
PID:116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2984-1-0x0000000000400000-0x00000000006E1000-memory.dmp

Filesize
2.9MB

Download
memory/2984-2-0x0000000000400000-0x00000000006E1000-memory.dmp

Filesize
2.9MB

Download
memory/2984-3-0x0000000000400000-0x00000000006E1000-memory.dmp

Filesize
2.9MB

Download
memory/2984-6-0x0000000000400000-0x00000000006E1000-memory.dmp

Filesize
2.9MB

Download
memory/2984-9-0x0000000000400000-0x00000000006E1000-memory.dmp

Filesize
2.9MB

Download
memory/2984-8-0x0000000000400000-0x00000000006E1000-memory.dmp

Filesize
2.9MB

Download
memory/2984-7-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/2984-5-0x0000000000400000-0x00000000006E1000-memory.dmp

Filesize
2.9MB

Download
memory/2984-4-0x0000000000400000-0x00000000006E1000-memory.dmp

Filesize
2.9MB

Download
memory/2984-0-0x0000000000400000-0x00000000006E1000-memory.dmp

Filesize
2.9MB

Download
memory/2984-20-0x0000000000400000-0x00000000006E1000-memory.dmp

Filesize
2.9MB

Download
memory/2984-21-0x0000000000400000-0x00000000006E1000-memory.dmp

Filesize
2.9MB

Download
memory/2984-22-0x0000000000400000-0x00000000006E1000-memory.dmp

Filesize
2.9MB

Download
memory/2984-23-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/2984-26-0x0000000000400000-0x00000000006E1000-memory.dmp

Filesize
2.9MB

Download
memory/2984-27-0x0000000000400000-0x00000000006E1000-memory.dmp

Filesize
2.9MB

Download
memory/2984-32-0x0000000000400000-0x00000000006E1000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing