Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31-12-2023 07:07
Behavioral task
behavioral1
Sample
2cc1c56d3f26aa6bc7a036efbde4a9d3.exe
Resource
win7-20231215-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2cc1c56d3f26aa6bc7a036efbde4a9d3.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
2cc1c56d3f26aa6bc7a036efbde4a9d3.exe
-
Size
867KB
-
MD5
2cc1c56d3f26aa6bc7a036efbde4a9d3
-
SHA1
0e84dbd9743f10efa4221b747a38c5a1d291be47
-
SHA256
449fd3e18ba5817154d52c59f5ba774f019a0e694b9278dc415998f5090c0587
-
SHA512
24793f4055bb3c5eae1dac86cb0639e1fae0cb7344558f8e623b8a9ad71a9712b07964bf0e1aa85006346981899f3fc1a833cc02fbb4e2a8c108e5aedd59be63
-
SSDEEP
24576:bsajHjIjzjbx72ItEbKBTy2WaBEMAfIGZJkUL:bns/x7HwKFPcZJR
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2408-0-0x0000000000400000-0x0000000000A0E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\Security Protection = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2cc1c56d3f26aa6bc7a036efbde4a9d3.exe" 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe File opened (read-only) \??\I: 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe File opened (read-only) \??\X: 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe File opened (read-only) \??\H: 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe File opened (read-only) \??\O: 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe File opened (read-only) \??\Q: 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe File opened (read-only) \??\T: 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe File opened (read-only) \??\W: 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe File opened (read-only) \??\Z: 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe File opened (read-only) \??\K: 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe File opened (read-only) \??\L: 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe File opened (read-only) \??\N: 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe File opened (read-only) \??\P: 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe File opened (read-only) \??\Y: 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe File opened (read-only) \??\U: 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe File opened (read-only) \??\V: 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe File opened (read-only) \??\G: 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe File opened (read-only) \??\J: 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe File opened (read-only) \??\M: 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe File opened (read-only) \??\R: 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe File opened (read-only) \??\S: 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe -
Suspicious use of FindShellTrayWindow 12 IoCs
pid Process 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe 2408 2cc1c56d3f26aa6bc7a036efbde4a9d3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cc1c56d3f26aa6bc7a036efbde4a9d3.exe"C:\Users\Admin\AppData\Local\Temp\2cc1c56d3f26aa6bc7a036efbde4a9d3.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2408
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1