f0cf196c36d6040e407c2f6f50f2599a6ac6e430e6741bb3b79d4282ba03efb3

General

Target

96b794b4088fea545b6040dd58e62e44.exe
Size

151KB
MD5

96b794b4088fea545b6040dd58e62e44
SHA1

dfda45f89d1bb0e012586d3594706106c0ce5f76
SHA256

f0cf196c36d6040e407c2f6f50f2599a6ac6e430e6741bb3b79d4282ba03efb3
SHA512

9b7f7da2338c789d58f29b2c215f0645b9610b3944eeb948209aae1b54b2d13040770272bc302738e1f5d67852792d9a78a2d93b5e92039724424894bf4d37b5
SSDEEP

3072:vSSknv7BYJlQXQ8p6g4bV/PkKjzeP/MOKYuNHL4YQ0qMlydsNUmXYe:qhCJCpp6gEkKuP/MOKV3Q0j0SNUQ

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	96b794b4088fea545b6040dd58e62e44.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\Q:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\P:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\O:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\N:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\L:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\K:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\X:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\M:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\J:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\I:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\H:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\G:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\W:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\V:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\S:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\Z:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\Y:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\T:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\R:	96b794b4088fea545b6040dd58e62e44.exe
File opened (read-only)	\??\E:	96b794b4088fea545b6040dd58e62e44.exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\autorun.inf	96b794b4088fea545b6040dd58e62e44.exe
File opened for modification	C:\autorun.inf	96b794b4088fea545b6040dd58e62e44.exe
File opened for modification	C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\CD Burning\autorun.inf	96b794b4088fea545b6040dd58e62e44.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACRORD32.EXE	96b794b4088fea545b6040dd58e62e44.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2908	436	WerFault.exe	88

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
436	96b794b4088fea545b6040dd58e62e44.exe
436	96b794b4088fea545b6040dd58e62e44.exe

C:\Users\Admin\AppData\Local\Temp\96b794b4088fea545b6040dd58e62e44.exe
"C:\Users\Admin\AppData\Local\Temp\96b794b4088fea545b6040dd58e62e44.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 740
  2⤵
  - Program crash
  PID:2908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 436 -ip 436
1⤵
PID:5112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\autorun.inf

Filesize
126B

MD5
163e20cbccefcdd42f46e43a94173c46

SHA1
4c7b5048e8608e2a75799e00ecf1bbb4773279ae

SHA256
7780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e

SHA512
e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8

Download Submit
C:\zPharaoh.exe

Filesize
152KB

MD5
90ca5b80b69c334f0307e944a5d8d139

SHA1
c7d5fdd6628142ac7ee8bf0710be81c108c02b91

SHA256
890223126b0f34cfb5695af209c2b5d218ecc00fe5a0be1693eb07f9559ac5bf

SHA512
06226f3c24880616b4984f81ff29f30370a91e28665617fe73963f098c411a2f25a43957ff0b8b100d9144adbb8170702a9ff28a599664c48b40c011fae17810

Download Submit
F:\zPharaoh.exe

Filesize
151KB

MD5
eb3c1aa1ddbf8dc161bb2c3c5f7c0975

SHA1
11242aabc34703cbf6bd4d38179accd05e4aaba7

SHA256
44ccb498cfdaea98e038639c45db1973d3f61201c36fb0bf6c0124b5409700f0

SHA512
3d1063f70d51d1a5ee3d35df47b25c746622347992583251510073cea6f8eb44f4c7fb20eb9e0effef4240126374174263c4f9fc515099de9daed2932768c26b

Download Submit
memory/436-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/436-28-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads