0cebf46fcd36f705ebffd3e8edd56f9c82e6f52aea425509f5f1da0a7008691b

General

Target

1940228162b5126395193072ce6e2168.exe
Size

158KB
MD5

1940228162b5126395193072ce6e2168
SHA1

74fdf3f84da08b54902ea94912a2cc2b202d888a
SHA256

0cebf46fcd36f705ebffd3e8edd56f9c82e6f52aea425509f5f1da0a7008691b
SHA512

09142b83138f4e73190ebca47f7e5eeab66c888dcf0d369ef1a8cb45992a11774d8d2ec55c1fe7e8f9b2ebb74faf9e2ed5bacc8fa52d70e1a627193c8206fc30
SSDEEP

3072:6X8Eb1Yj0ZsQnl+D9HiuFA95FkW3lhwyjenNpgMP4d4wBxveSaoSoYlcEmfQYVRP:6XXuj09nl+D9HiuFA95FkW3lhwyjenNw

Score

10^/10

evasion

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

Hidden Files and Directories

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	1940228162b5126395193072ce6e2168.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

Hidden Files and Directories

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	1940228162b5126395193072ce6e2168.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

System Information Discovery

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

description	ioc	Process
File opened for modification	F:\autorun.inf	1940228162b5126395193072ce6e2168.exe
File opened for modification	C:\autorun.inf	1940228162b5126395193072ce6e2168.exe
File opened for modification	C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\CD Burning\autorun.inf	1940228162b5126395193072ce6e2168.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\OUTLOOK.EXE	1940228162b5126395193072ce6e2168.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\EXCEL.EXE	1940228162b5126395193072ce6e2168.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\GROOVE.EXE	1940228162b5126395193072ce6e2168.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\INFOPATH.EXE	1940228162b5126395193072ce6e2168.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\MSACCESS.EXE	1940228162b5126395193072ce6e2168.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\MSPUB.EXE	1940228162b5126395193072ce6e2168.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\OIS.EXE	1940228162b5126395193072ce6e2168.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\ONENOTE.EXE	1940228162b5126395193072ce6e2168.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2592	2548	WerFault.exe	1

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2548	1940228162b5126395193072ce6e2168.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2592	2548	1940228162b5126395193072ce6e2168.exe	16
PID 2548 wrote to memory of 2592	2548	1940228162b5126395193072ce6e2168.exe	16
PID 2548 wrote to memory of 2592	2548	1940228162b5126395193072ce6e2168.exe	16
PID 2548 wrote to memory of 2592	2548	1940228162b5126395193072ce6e2168.exe	16

C:\Users\Admin\AppData\Local\Temp\1940228162b5126395193072ce6e2168.exe
"C:\Users\Admin\AppData\Local\Temp\1940228162b5126395193072ce6e2168.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 316
  2⤵
  - Program crash
  PID:2592