0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e

General

Target

0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe
Size

277KB
MD5

1ba9aa5710b0bf3e271329994311d4a0
SHA1

d6fbad1833aa5285de18e425af58bc3420722c4b
SHA256

0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e
SHA512

8f81ddf7c6ab01fe04a04daec1bb9af87ed3cb9cc195d8628c7f5a896aff38f798d00499b9110761cfedada42e3a23c818516c17243aad081590bd0831f6ac71
SSDEEP

6144:6Z1gm4z+Rp4PCL8YM6c2G/FtmUPvo39UPdTNN4:6l4qnM6c26s39UNN4

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2040 created 1188	2040	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe	16

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe
File opened (read-only)	\??\M:	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe
File opened (read-only)	\??\N:	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe
File opened (read-only)	\??\P:	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe
File opened (read-only)	\??\R:	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe
File opened (read-only)	\??\W:	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe
File opened (read-only)	\??\A:	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe
File opened (read-only)	\??\B:	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe
File opened (read-only)	\??\E:	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe
File opened (read-only)	\??\H:	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe
File opened (read-only)	\??\I:	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe
File opened (read-only)	\??\Y:	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe
File opened (read-only)	\??\Z:	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe
File opened (read-only)	\??\G:	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe
File opened (read-only)	\??\L:	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe
File opened (read-only)	\??\T:	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe
File opened (read-only)	\??\U:	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe
File opened (read-only)	\??\X:	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe
File opened (read-only)	\??\J:	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe
File opened (read-only)	\??\O:	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe
File opened (read-only)	\??\Q:	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe
File opened (read-only)	\??\S:	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe
File opened (read-only)	\??\V:	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2956	2040	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe	29
PID 2040 wrote to memory of 2956	2040	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe	29
PID 2040 wrote to memory of 2956	2040	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe	29
PID 2040 wrote to memory of 2956	2040	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe	29
PID 2956 wrote to memory of 2628	2956	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe	31
PID 2956 wrote to memory of 2628	2956	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe	31
PID 2956 wrote to memory of 2628	2956	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe	31
PID 2956 wrote to memory of 2628	2956	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe	31
PID 2040 wrote to memory of 2556	2040	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe	32
PID 2040 wrote to memory of 2556	2040	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe	32
PID 2040 wrote to memory of 2556	2040	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe	32
PID 2040 wrote to memory of 2556	2040	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe	32

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1188
- C:\Users\Admin\AppData\Local\Temp\0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe
  "C:\Users\Admin\AppData\Local\Temp\0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Enumerates connected drives
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2040
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c pause
    3⤵
    PID:2556
- C:\Users\Admin\AppData\Local\Temp\0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe
  \\?\C:\Users\Admin\AppData\Local\Temp\0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe -network
  2⤵
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2956
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c pause
    3⤵
    PID:2628