6a176bc0841cf4f5c1d5947aa53882a0c247fa29e42efb228a6534a02417018d

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 23:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2084d778e3a6b8fc19e33ac20157e5ef.exe
Size

944KB
MD5

2084d778e3a6b8fc19e33ac20157e5ef
SHA1

6816392ca9032ba08706f8830b9df6c7f9b240be
SHA256

6a176bc0841cf4f5c1d5947aa53882a0c247fa29e42efb228a6534a02417018d
SHA512

ea8837da4e8e11a488dfd1e281764bec217f8e99ba970e9b5f5d64ed4f4971b0152d24dda1b26791e306791874cadca3fec9818c5ef4baaf9c46ff1303219973
SSDEEP

24576:TE6NiCxCpig+rb5QwvgLtZNqpZJeukYJpXNVOx6kHiEvhBlZ8bPNCXwA/60qJ0QG:TEPMruZNJYJgDi0HlKbNCXwA/60qJ0QG

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	2084d778e3a6b8fc19e33ac20157e5ef.exe
File opened (read-only)	\??\H:	2084d778e3a6b8fc19e33ac20157e5ef.exe
File opened (read-only)	\??\M:	2084d778e3a6b8fc19e33ac20157e5ef.exe
File opened (read-only)	\??\S:	2084d778e3a6b8fc19e33ac20157e5ef.exe
File opened (read-only)	\??\J:	2084d778e3a6b8fc19e33ac20157e5ef.exe
File opened (read-only)	\??\L:	2084d778e3a6b8fc19e33ac20157e5ef.exe
File opened (read-only)	\??\O:	2084d778e3a6b8fc19e33ac20157e5ef.exe
File opened (read-only)	\??\P:	2084d778e3a6b8fc19e33ac20157e5ef.exe
File opened (read-only)	\??\Q:	2084d778e3a6b8fc19e33ac20157e5ef.exe
File opened (read-only)	\??\R:	2084d778e3a6b8fc19e33ac20157e5ef.exe
File opened (read-only)	\??\I:	2084d778e3a6b8fc19e33ac20157e5ef.exe
File opened (read-only)	\??\U:	2084d778e3a6b8fc19e33ac20157e5ef.exe
File opened (read-only)	\??\V:	2084d778e3a6b8fc19e33ac20157e5ef.exe
File opened (read-only)	\??\W:	2084d778e3a6b8fc19e33ac20157e5ef.exe
File opened (read-only)	\??\X:	2084d778e3a6b8fc19e33ac20157e5ef.exe
File opened (read-only)	\??\Y:	2084d778e3a6b8fc19e33ac20157e5ef.exe
File opened (read-only)	\??\Z:	2084d778e3a6b8fc19e33ac20157e5ef.exe
File opened (read-only)	\??\G:	2084d778e3a6b8fc19e33ac20157e5ef.exe
File opened (read-only)	\??\K:	2084d778e3a6b8fc19e33ac20157e5ef.exe
File opened (read-only)	\??\N:	2084d778e3a6b8fc19e33ac20157e5ef.exe
File opened (read-only)	\??\T:	2084d778e3a6b8fc19e33ac20157e5ef.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	2084d778e3a6b8fc19e33ac20157e5ef.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.exe	2084d778e3a6b8fc19e33ac20157e5ef.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2084d778e3a6b8fc19e33ac20157e5ef.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2084d778e3a6b8fc19e33ac20157e5ef.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2084d778e3a6b8fc19e33ac20157e5ef.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2084d778e3a6b8fc19e33ac20157e5ef.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2084d778e3a6b8fc19e33ac20157e5ef.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2084d778e3a6b8fc19e33ac20157e5ef.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2084d778e3a6b8fc19e33ac20157e5ef.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2084d778e3a6b8fc19e33ac20157e5ef.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2084d778e3a6b8fc19e33ac20157e5ef.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2084d778e3a6b8fc19e33ac20157e5ef.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2084d778e3a6b8fc19e33ac20157e5ef.exe
File created	C:\Program Files\7-Zip\Uninstall.ivr	2084d778e3a6b8fc19e33ac20157e5ef.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4176	2084d778e3a6b8fc19e33ac20157e5ef.exe
4176	2084d778e3a6b8fc19e33ac20157e5ef.exe

C:\Users\Admin\AppData\Local\Temp\2084d778e3a6b8fc19e33ac20157e5ef.exe
"C:\Users\Admin\AppData\Local\Temp\2084d778e3a6b8fc19e33ac20157e5ef.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Uninstall.ivr

Filesize
119KB

MD5
f187aa5e113b580780dd20d7f585c968

SHA1
b7c37cd3c5ab217b30e6dafb41858667697f7b0f

SHA256
39ce5c922a6ae9766a622a2b86e99bb6a250f35352f1906723afa68ec51e6383

SHA512
9a2e8539bee8de7ac5e1bcb615ec931b6d78a65c3c3d6cba1426050846f6f367684568dce67f3fe2ae52f65bbb133db1e53f2e89667816e1347002835ddc7815

Download Submit