Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
27/02/2024, 17:32
Behavioral task
behavioral1
Sample
0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe
- Size 277KB
- Sample240227-v4j2ssfd2w
- SHA256 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e
- MD5 1ba9aa5710b0bf3e271329994311d4a0
- SHA1 d6fbad1833aa5285de18e425af58bc3420722c4b
- SHA512 8f81ddf7c6ab01fe04a04daec1bb9af87ed3cb9cc195d8628c7f5a896aff38f798d00499b9110761cfedada42e3a23c818516c17243aad081590bd0831f6ac71
- SSDEEP 6144:6Z1gm4z+Rp4PCL8YM6c2G/FtmUPvo39UPdTNN4:6l4qnM6c26s39UNN4
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 2316 created 3484 2316 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe 24 - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe File opened (read-only) \??\I: 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe File opened (read-only) \??\L: 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe File opened (read-only) \??\P: 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe File opened (read-only) \??\U: 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe File opened (read-only) \??\Z: 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe File opened (read-only) \??\J: 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe File opened (read-only) \??\M: 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe File opened (read-only) \??\O: 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe File opened (read-only) \??\S: 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe File opened (read-only) \??\V: 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe File opened (read-only) \??\X: 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe File opened (read-only) \??\A: 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe File opened (read-only) \??\G: 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe File opened (read-only) \??\K: 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe File opened (read-only) \??\W: 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe File opened (read-only) \??\Y: 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe File opened (read-only) \??\E: 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe File opened (read-only) \??\H: 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe File opened (read-only) \??\N: 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe File opened (read-only) \??\Q: 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe File opened (read-only) \??\R: 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe File opened (read-only) \??\T: 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2316 wrote to memory of 772 2316 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe 91 PID 2316 wrote to memory of 772 2316 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe 91 PID 2316 wrote to memory of 772 2316 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe 91 PID 772 wrote to memory of 224 772 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe 93 PID 772 wrote to memory of 224 772 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe 93 PID 772 wrote to memory of 224 772 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe 93 PID 2316 wrote to memory of 4548 2316 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe 100 PID 2316 wrote to memory of 4548 2316 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe 100 PID 2316 wrote to memory of 4548 2316 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe 100 - System policy modification 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe"C:\Users\Admin\AppData\Local\Temp\0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c pause3⤵PID:4548
-
-
-
C:\Users\Admin\AppData\Local\Temp\0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe\\?\C:\Users\Admin\AppData\Local\Temp\0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.exe -network2⤵
- Suspicious use of WriteProcessMemory
- System policy modification
PID:772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c pause3⤵PID:224
-
-