564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6

General

Target

564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
Size

277KB
MD5

f739f6865c55f938aedc8786bd8fa941
SHA1

992323180ff9a232c8726625ccb064470dad7fa7
SHA256

564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6
SHA512

5f883ed6266a31b29a629193f6a139f83b26a0862fd3e25d9dcd2469d54a63433f472afca3b862f22b3e0e6ec09cbad4fbb9b4229b993fb6343c132329220957
SSDEEP

6144:SZ1gm4z+Rp4PCL8YM6c2G/FtmUPvo39UPdENN4:il4qnM6c26s39HNN4

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe

description pid process target process

PID 1136 created 1352 1136 564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe Explorer.EXE

description	pid	process	target process
PID 1136 created 1352	1136	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe	Explorer.EXE

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe

description	ioc	process
File opened (read-only)	\??\M:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\Q:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\U:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\A:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\I:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\L:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\V:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\W:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\Y:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\G:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\O:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\P:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\X:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\Z:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\B:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\E:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\K:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\R:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\S:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\T:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\H:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\J:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\N:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe

description	pid	process	target process
PID 1136 wrote to memory of 2012	1136	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
PID 1136 wrote to memory of 2012	1136	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
PID 1136 wrote to memory of 2012	1136	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
PID 1136 wrote to memory of 2012	1136	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
PID 2012 wrote to memory of 2632	2012	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe	cmd.exe
PID 2012 wrote to memory of 2632	2012	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe	cmd.exe
PID 2012 wrote to memory of 2632	2012	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe	cmd.exe
PID 2012 wrote to memory of 2632	2012	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe	cmd.exe
PID 1136 wrote to memory of 2680	1136	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe	cmd.exe
PID 1136 wrote to memory of 2680	1136	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe	cmd.exe
PID 1136 wrote to memory of 2680	1136	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe	cmd.exe
PID 1136 wrote to memory of 2680	1136	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe	cmd.exe

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

Processes:

564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1352
- C:\Users\Admin\AppData\Local\Temp\564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
  "C:\Users\Admin\AppData\Local\Temp\564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Enumerates connected drives
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1136
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c pause
    3⤵
    PID:2680
- C:\Users\Admin\AppData\Local\Temp\564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
  \\?\C:\Users\Admin\AppData\Local\Temp\564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe -network
  2⤵
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2012
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c pause
    3⤵
    PID:2632