Analysis
-
max time kernel
137s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/01/2024, 15:15
Static task
static1
Behavioral task
behavioral1
Sample
6fc242c9d7b672b492b398d92e64d428.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6fc242c9d7b672b492b398d92e64d428.exe
Resource
win10v2004-20231215-en
General
-
Target
6fc242c9d7b672b492b398d92e64d428.exe
-
Size
32KB
-
MD5
6fc242c9d7b672b492b398d92e64d428
-
SHA1
112428ad31675278b95bc67c3074d4c6c6112716
-
SHA256
ea351abcc64470fe2ef18b3dc2e5c3cead069b5917237c4b1e51c376472a18e0
-
SHA512
1e2a01e16e21119d0d00ed41b64ec4a25537c25801c93ed59b39d2d0123b27df8f86094b60bd7c5f5edf16369322f303945728dbe4c953c5f0759e500eab834e
-
SSDEEP
384:OCYxB7PvvNdu9hBw7+/JwS3Y/1/BFU8a/EmZwDGSK7EU:OTBzvvN4XBP13m1/vU8eEm4Bd
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: 6fc242c9d7b672b492b398d92e64d428.exe File opened (read-only) \??\X: 6fc242c9d7b672b492b398d92e64d428.exe File opened (read-only) \??\Z: 6fc242c9d7b672b492b398d92e64d428.exe File opened (read-only) \??\I: 6fc242c9d7b672b492b398d92e64d428.exe File opened (read-only) \??\J: 6fc242c9d7b672b492b398d92e64d428.exe File opened (read-only) \??\O: 6fc242c9d7b672b492b398d92e64d428.exe File opened (read-only) \??\P: 6fc242c9d7b672b492b398d92e64d428.exe File opened (read-only) \??\W: 6fc242c9d7b672b492b398d92e64d428.exe File opened (read-only) \??\H: 6fc242c9d7b672b492b398d92e64d428.exe File opened (read-only) \??\L: 6fc242c9d7b672b492b398d92e64d428.exe File opened (read-only) \??\N: 6fc242c9d7b672b492b398d92e64d428.exe File opened (read-only) \??\Q: 6fc242c9d7b672b492b398d92e64d428.exe File opened (read-only) \??\T: 6fc242c9d7b672b492b398d92e64d428.exe File opened (read-only) \??\B: 6fc242c9d7b672b492b398d92e64d428.exe File opened (read-only) \??\K: 6fc242c9d7b672b492b398d92e64d428.exe File opened (read-only) \??\M: 6fc242c9d7b672b492b398d92e64d428.exe File opened (read-only) \??\S: 6fc242c9d7b672b492b398d92e64d428.exe File opened (read-only) \??\U: 6fc242c9d7b672b492b398d92e64d428.exe File opened (read-only) \??\V: 6fc242c9d7b672b492b398d92e64d428.exe File opened (read-only) \??\Y: 6fc242c9d7b672b492b398d92e64d428.exe File opened (read-only) \??\A: 6fc242c9d7b672b492b398d92e64d428.exe File opened (read-only) \??\E: 6fc242c9d7b672b492b398d92e64d428.exe File opened (read-only) \??\G: 6fc242c9d7b672b492b398d92e64d428.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 4492 6fc242c9d7b672b492b398d92e64d428.exe Token: SeCreatePagefilePrivilege 4492 6fc242c9d7b672b492b398d92e64d428.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4492 6fc242c9d7b672b492b398d92e64d428.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b