6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30

General

Target

6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe
Size

308KB
MD5

a33262199abfa39774d5f5e69957dde8
SHA1

0792fe4d9f514d587edf772aa6acc6d0879e4974
SHA256

6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30
SHA512

958f569a47284b2ee41e9754d529b80078dcd218cc8a7bbdcf372589f0ea9dbfb8f69ef7b116f6c057edf4159373ed38dcbf17c7757a5f8f0236e68e91b89a88
SSDEEP

6144:Ek4DdotiH8um78UhQyZ72VQShKLzuTHDZnV24lYgfg:L61m7rhQyZiBzegf

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2292 created 1160	2292	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe	8

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe
File opened (read-only)	\??\Y:	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe
File opened (read-only)	\??\B:	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe
File opened (read-only)	\??\I:	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe
File opened (read-only)	\??\L:	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe
File opened (read-only)	\??\O:	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe
File opened (read-only)	\??\U:	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe
File opened (read-only)	\??\W:	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe
File opened (read-only)	\??\A:	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe
File opened (read-only)	\??\J:	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe
File opened (read-only)	\??\Q:	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe
File opened (read-only)	\??\T:	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe
File opened (read-only)	\??\E:	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe
File opened (read-only)	\??\H:	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe
File opened (read-only)	\??\K:	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe
File opened (read-only)	\??\R:	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe
File opened (read-only)	\??\S:	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe
File opened (read-only)	\??\V:	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe
File opened (read-only)	\??\Z:	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe
File opened (read-only)	\??\G:	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe
File opened (read-only)	\??\M:	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe
File opened (read-only)	\??\N:	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe
File opened (read-only)	\??\P:	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 1376	2292	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe	29
PID 2292 wrote to memory of 1376	2292	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe	29
PID 2292 wrote to memory of 1376	2292	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe	29
PID 2292 wrote to memory of 1376	2292	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe	29
PID 1376 wrote to memory of 2540	1376	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe	32
PID 1376 wrote to memory of 2540	1376	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe	32
PID 1376 wrote to memory of 2540	1376	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe	32
PID 1376 wrote to memory of 2540	1376	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe	32
PID 2292 wrote to memory of 2772	2292	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe	33
PID 2292 wrote to memory of 2772	2292	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe	33
PID 2292 wrote to memory of 2772	2292	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe	33
PID 2292 wrote to memory of 2772	2292	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe	33

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1160
- C:\Users\Admin\AppData\Local\Temp\6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe
  "C:\Users\Admin\AppData\Local\Temp\6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Enumerates connected drives
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2292
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c pause
    3⤵
    PID:2772
- C:\Users\Admin\AppData\Local\Temp\6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe
  \\?\C:\Users\Admin\AppData\Local\Temp\6673441d5e4c3adcbe670fd4025b90549bbc259224653a6795c123d59ff92a30.exe -network
  2⤵
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1376
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c pause
    3⤵
    PID:2540