f0cf196c36d6040e407c2f6f50f2599a6ac6e430e6741bb3b79d4282ba03efb3

General

Target

96b794b4088fea545b6040dd58e62e44.exe
Size

151KB
MD5

96b794b4088fea545b6040dd58e62e44
SHA1

dfda45f89d1bb0e012586d3594706106c0ce5f76
SHA256

f0cf196c36d6040e407c2f6f50f2599a6ac6e430e6741bb3b79d4282ba03efb3
SHA512

9b7f7da2338c789d58f29b2c215f0645b9610b3944eeb948209aae1b54b2d13040770272bc302738e1f5d67852792d9a78a2d93b5e92039724424894bf4d37b5
SSDEEP

3072:vSSknv7BYJlQXQ8p6g4bV/PkKjzeP/MOKYuNHL4YQ0qMlydsNUmXYe:qhCJCpp6gEkKuP/MOKV3Q0j0SNUQ

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	96b794b4088fea545b6040dd58e62e44.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	96b794b4088fea545b6040dd58e62e44.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\L:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\J:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\I:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\Z:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\Y:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\W:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\U:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\P:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\N:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\M:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\H:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\X:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\V:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\T:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\R:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\E:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\S:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\Q:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\K:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\G:	96b794b4088fea545b6040dd58e62e44.exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\autorun.inf	96b794b4088fea545b6040dd58e62e44.exe
File opened for modification	C:\autorun.inf	96b794b4088fea545b6040dd58e62e44.exe
File opened for modification	C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\CD Burning\autorun.inf	96b794b4088fea545b6040dd58e62e44.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\EXCEL.EXE	96b794b4088fea545b6040dd58e62e44.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\GROOVE.EXE	96b794b4088fea545b6040dd58e62e44.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\INFOPATH.EXE	96b794b4088fea545b6040dd58e62e44.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\MSACCESS.EXE	96b794b4088fea545b6040dd58e62e44.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\MSPUB.EXE	96b794b4088fea545b6040dd58e62e44.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\OIS.EXE	96b794b4088fea545b6040dd58e62e44.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\ONENOTE.EXE	96b794b4088fea545b6040dd58e62e44.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2976	96b794b4088fea545b6040dd58e62e44.exe

C:\Users\Admin\AppData\Local\Temp\96b794b4088fea545b6040dd58e62e44.exe
"C:\Users\Admin\AppData\Local\Temp\96b794b4088fea545b6040dd58e62e44.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

2

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\autorun.inf

Filesize
126B

MD5
163e20cbccefcdd42f46e43a94173c46

SHA1
4c7b5048e8608e2a75799e00ecf1bbb4773279ae

SHA256
7780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e

SHA512
e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8

Download Submit
C:\zPharaoh.exe

Filesize
152KB

MD5
387929d78edcc8eb1153826906d20259

SHA1
865f6035c1e8f738249b3b623d75dba80f3fd24b

SHA256
aacd6408130b201c576596cd6fdec7e6cfc588d364663e3e81df5253acf05c53

SHA512
2dd65478b566d0e59402ead71daeaf8d3501faa6da3e405260b628495b331a4c83cab4f6ee9125f7e6a76b6b0f1ffaa79dfbf810f3840e2352e08c06a769ee05

Download Submit
F:\zPharaoh.exe

Filesize
152KB

MD5
aa272d5c04fd8df4151ad6e7659e725f

SHA1
c6f55b045ccc1197cbc3a1b740105d51ee160574

SHA256
d48d3093480688115b937affcb5d350654f9f25801de16ac363d7ab4dd257f71

SHA512
a83f7618eddf63b4e2438a47591ad4308cc77b2d49f1db17c579983eb8e9a2e2bb001c3c4193fbfa9bf805cef106e657c878ec2489d81566beaf1d9db1f38db6

Download Submit
memory/2976-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2976-34-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads