7d8754684cd4756078c4e9232fa549971dd4c4e3679e3be6a70bda6bd26a0807

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 19:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe
Size 70KB
Sample240107-ycql2scgcm
SHA256 7d8754684cd4756078c4e9232fa549971dd4c4e3679e3be6a70bda6bd26a0807
MD5 8e4149ba2bb60acedb7823d0dac3b1dd
SHA1 b2213cf09ca6d0d8d797751e2283d929d1c27485
SHA512 449338e9873cc33c58d4c32c50d6c77fd1556f655694b2f063bcaeaf7858085bf56238a1dac6a70d48696618a69b883d568df47bf957f67be2d1db224a2fa310
SSDEEP 1536:bZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:ad5BJHMqqDL2/Ovvdr
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\erbqqayycyq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe"	202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe
File opened (read-only)	\??\O:	202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe
File opened (read-only)	\??\E:	202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe
File opened (read-only)	\??\N:	202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe
File opened (read-only)	\??\S:	202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe
File opened (read-only)	\??\T:	202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe
File opened (read-only)	\??\V:	202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe
File opened (read-only)	\??\W:	202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe
File opened (read-only)	\??\Z:	202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe
File opened (read-only)	\??\B:	202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe
File opened (read-only)	\??\M:	202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe
File opened (read-only)	\??\P:	202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe
File opened (read-only)	\??\Q:	202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe
File opened (read-only)	\??\R:	202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe
File opened (read-only)	\??\H:	202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe
File opened (read-only)	\??\I:	202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe
File opened (read-only)	\??\J:	202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe
File opened (read-only)	\??\K:	202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe
File opened (read-only)	\??\L:	202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe
File opened (read-only)	\??\U:	202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe
File opened (read-only)	\??\X:	202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe
File opened (read-only)	\??\Y:	202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe
File opened (read-only)	\??\A:	202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2400	202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe
2400	202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe
2400	202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe
2400	202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe

C:\Users\Admin\AppData\Local\Temp\202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe
"C:\Users\Admin\AppData\Local\Temp\202401068e4149ba2bb60acedb7823d0dac3b1ddgandcrab.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2400