52a3ebb031951a47f40d26ecd19be04bd2eace99488a82b7069bf003f116ee25

Analysis

max time kernel
150s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13-02-2024 22:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a1441d5e7542f3f09bea620dee9a781.exe
Size

24KB
MD5

9a1441d5e7542f3f09bea620dee9a781
SHA1

99026c3d56b8e22299bbfe2721eab61f9ac3a692
SHA256

52a3ebb031951a47f40d26ecd19be04bd2eace99488a82b7069bf003f116ee25
SHA512

bf937b9e2b6575c81b5db0895ec2ac0be87450b0566433139ac72fd48578346d8a0476b46ed1a39ada37dd10d0315571bae99e7b1d4d0e9e01471b5a459d6bdb
SSDEEP

384:ZCIAm1aApMC7aHeYZf4km5StBuBoE1mCWN0km5S4:ZL1dJ7KeYZwkm5SjYo2mCWN0km5S4

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\9a1441d5e7542f3f09bea620dee9a781 = "9a1441d5e7542f3f09bea620dee9a781.exe"	9a1441d5e7542f3f09bea620dee9a781.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	9a1441d5e7542f3f09bea620dee9a781.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\stray.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Windows\SysWOW64\stray.exe	9a1441d5e7542f3f09bea620dee9a781.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	9a1441d5e7542f3f09bea620dee9a781.exe

C:\Users\Admin\AppData\Local\Temp\9a1441d5e7542f3f09bea620dee9a781.exe
"C:\Users\Admin\AppData\Local\Temp\9a1441d5e7542f3f09bea620dee9a781.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
PID:236