564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6

General

Target

564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
Size

277KB
MD5

f739f6865c55f938aedc8786bd8fa941
SHA1

992323180ff9a232c8726625ccb064470dad7fa7
SHA256

564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6
SHA512

5f883ed6266a31b29a629193f6a139f83b26a0862fd3e25d9dcd2469d54a63433f472afca3b862f22b3e0e6ec09cbad4fbb9b4229b993fb6343c132329220957
SSDEEP

6144:SZ1gm4z+Rp4PCL8YM6c2G/FtmUPvo39UPdENN4:il4qnM6c26s39HNN4

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe

description	pid	Process	procid_target
PID 4356 created 3296	4356	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe	51

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe

description	ioc	Process
File opened (read-only)	\??\B:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\E:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\M:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\T:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\G:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\L:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\O:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\S:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\X:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\A:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\H:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\I:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\K:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\V:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\Z:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\J:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\N:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\P:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\Q:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\R:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\U:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\W:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
File opened (read-only)	\??\Y:	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe

description	pid	Process	procid_target
PID 4356 wrote to memory of 436	4356	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe	99
PID 4356 wrote to memory of 436	4356	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe	99
PID 4356 wrote to memory of 436	4356	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe	99
PID 436 wrote to memory of 2912	436	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe	101
PID 436 wrote to memory of 2912	436	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe	101
PID 436 wrote to memory of 2912	436	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe	101
PID 4356 wrote to memory of 2256	4356	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe	107
PID 4356 wrote to memory of 2256	4356	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe	107
PID 4356 wrote to memory of 2256	4356	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe	107

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

Processes:

564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3296
- C:\Users\Admin\AppData\Local\Temp\564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
  "C:\Users\Admin\AppData\Local\Temp\564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Enumerates connected drives
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4356
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c pause
    3⤵
    PID:2256
- C:\Users\Admin\AppData\Local\Temp\564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe
  \\?\C:\Users\Admin\AppData\Local\Temp\564dd895beba4f060b55d76a578baea5b63ec9a81bbef4e72cd6d499d37f6dc6.exe -network
  2⤵
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c pause
    3⤵
    PID:2912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3748 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:1628