60ef7c6a8f3b91627902b3ff444f6f81d5bc9fd2ffaa90ad13d8c2a5f5311b5f

General

Target

4592137e798ed337af247ef7229a3f1f.exe
Size

960KB
MD5

4592137e798ed337af247ef7229a3f1f
SHA1

549740763275c3d7ea4e7d6bd5995c774bc1dc01
SHA256

60ef7c6a8f3b91627902b3ff444f6f81d5bc9fd2ffaa90ad13d8c2a5f5311b5f
SHA512

7cd3bd6d05d66cbf0525296bbfaed29a253c534e47d082b99a50f4cd3925fa966c6b4a1450c6ef032f0afde21ee77b55d28e084871b055b6b5953ae28cf36e15
SSDEEP

12288:X6Wq4aaE6KwyF5L0Y2D1PqLb6Wq4aaE6KwyF5L0Y2D1PqLx6Wq4aaE6KwyF5L0YC:1thEVaPqLBthEVaPqLHthEVaPqLTthY

Score

10^/10

evasion upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	svhost.exe

Executes dropped EXE 1 IoCs

pid	Process
3712	svhost.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/668-0-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral2/files/0x000c000000023156-4.dat	upx
behavioral2/memory/3712-5-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral2/files/0x000c000000023156-3.dat	upx
behavioral2/memory/668-769-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral2/memory/3712-2639-0x0000000000400000-0x0000000000523000-memory.dmp	upx

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	svhost.exe
File opened (read-only)	\??\j:	svhost.exe
File opened (read-only)	\??\r:	svhost.exe
File opened (read-only)	\??\g:	svhost.exe
File opened (read-only)	\??\h:	svhost.exe
File opened (read-only)	\??\y:	svhost.exe
File opened (read-only)	\??\z:	svhost.exe
File opened (read-only)	\??\l:	svhost.exe
File opened (read-only)	\??\u:	svhost.exe
File opened (read-only)	\??\k:	svhost.exe
File opened (read-only)	\??\q:	svhost.exe
File opened (read-only)	\??\s:	svhost.exe
File opened (read-only)	\??\t:	svhost.exe
File opened (read-only)	\??\v:	svhost.exe
File opened (read-only)	\??\w:	svhost.exe
File opened (read-only)	\??\a:	svhost.exe
File opened (read-only)	\??\e:	svhost.exe
File opened (read-only)	\??\x:	svhost.exe
File opened (read-only)	\??\n:	svhost.exe
File opened (read-only)	\??\o:	svhost.exe
File opened (read-only)	\??\p:	svhost.exe
File opened (read-only)	\??\b:	svhost.exe
File opened (read-only)	\??\m:	svhost.exe

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/3712-5-0x0000000000400000-0x0000000000523000-memory.dmp	autoit_exe
behavioral2/memory/668-769-0x0000000000400000-0x0000000000523000-memory.dmp	autoit_exe
behavioral2/memory/3712-2639-0x0000000000400000-0x0000000000523000-memory.dmp	autoit_exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svhost.exe	4592137e798ed337af247ef7229a3f1f.exe
File opened for modification	C:\Windows\Driver.db	svhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
668	4592137e798ed337af247ef7229a3f1f.exe
668	4592137e798ed337af247ef7229a3f1f.exe
3712	svhost.exe
3712	svhost.exe
3712	svhost.exe
3712	svhost.exe
3712	svhost.exe
3712	svhost.exe

Suspicious use of FindShellTrayWindow 14 IoCs

pid	Process
668	4592137e798ed337af247ef7229a3f1f.exe
668	4592137e798ed337af247ef7229a3f1f.exe
3712	svhost.exe
3712	svhost.exe
668	4592137e798ed337af247ef7229a3f1f.exe
3712	svhost.exe
668	4592137e798ed337af247ef7229a3f1f.exe
3712	svhost.exe
668	4592137e798ed337af247ef7229a3f1f.exe
3712	svhost.exe
668	4592137e798ed337af247ef7229a3f1f.exe
3712	svhost.exe
668	4592137e798ed337af247ef7229a3f1f.exe
3712	svhost.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
668	4592137e798ed337af247ef7229a3f1f.exe
668	4592137e798ed337af247ef7229a3f1f.exe
3712	svhost.exe
3712	svhost.exe
668	4592137e798ed337af247ef7229a3f1f.exe
3712	svhost.exe
668	4592137e798ed337af247ef7229a3f1f.exe
3712	svhost.exe
668	4592137e798ed337af247ef7229a3f1f.exe
3712	svhost.exe
668	4592137e798ed337af247ef7229a3f1f.exe
3712	svhost.exe
668	4592137e798ed337af247ef7229a3f1f.exe
3712	svhost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 668 wrote to memory of 3712	668	4592137e798ed337af247ef7229a3f1f.exe	22
PID 668 wrote to memory of 3712	668	4592137e798ed337af247ef7229a3f1f.exe	22
PID 668 wrote to memory of 3712	668	4592137e798ed337af247ef7229a3f1f.exe	22

C:\Users\Admin\AppData\Local\Temp\4592137e798ed337af247ef7229a3f1f.exe
"C:\Users\Admin\AppData\Local\Temp\4592137e798ed337af247ef7229a3f1f.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:668
- C:\Windows\svhost.exe
  C:\Windows\svhost.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\svhost.exe

Filesize
92KB

MD5
0892c111b7a634c14f82c4da09d87540

SHA1
17fa0b99331713c5ea60f01af001d1b0f54050d9

SHA256
50af4ca0d0a49daaf6aa816f86a6e4369d7a831dedbb16ca99f6515881b70b38

SHA512
45960e9c23a4107ff8327210268f8d8e321b2f8aef6f78fd312afb35926b887898ab745557a11ae59abd208f8282c43a1c22947650bb3057e9b0b7d19dba8444

Download Submit
memory/668-0-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/668-769-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/3712-5-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/3712-2639-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing