Analysis
- max time kernel
121s - max time network
123s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
27/02/2024, 17:49
Behavioral task
behavioral1
Sample
9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
- Size 277KB
- Sample240227-wea82afd93
- SHA256 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7
- MD5 d037f5c167b01849d267696695a919ef
- SHA1 457ae227d1b63f295afbe18b539ff3b258f44a32
- SHA512 dcfb23c34be7688c292376c605b38eab3087fccd42b3dcd1708062dfee63e972c01107db505c90dc4db2f982bb5ea54fe2f9df9227e87b996a0346d0ea4c9a21
- SSDEEP 6144:6Z1gm4z+Rp4PCL8YM6c2G/FtmUPvo39UPdwNN4:6l4qnM6c26s39jNN4
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 2188 created 1192 2188 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe 7 - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe File opened (read-only) \??\U: 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe File opened (read-only) \??\Z: 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe File opened (read-only) \??\A: 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe File opened (read-only) \??\H: 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe File opened (read-only) \??\N: 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe File opened (read-only) \??\O: 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe File opened (read-only) \??\B: 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe File opened (read-only) \??\E: 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe File opened (read-only) \??\M: 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe File opened (read-only) \??\V: 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe File opened (read-only) \??\Y: 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe File opened (read-only) \??\G: 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe File opened (read-only) \??\J: 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe File opened (read-only) \??\L: 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe File opened (read-only) \??\W: 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe File opened (read-only) \??\S: 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe File opened (read-only) \??\T: 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe File opened (read-only) \??\X: 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe File opened (read-only) \??\I: 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe File opened (read-only) \??\K: 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe File opened (read-only) \??\Q: 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe File opened (read-only) \??\R: 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2504 2188 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe 29 PID 2188 wrote to memory of 2504 2188 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe 29 PID 2188 wrote to memory of 2504 2188 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe 29 PID 2188 wrote to memory of 2504 2188 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe 29 PID 2504 wrote to memory of 2624 2504 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe 31 PID 2504 wrote to memory of 2624 2504 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe 31 PID 2504 wrote to memory of 2624 2504 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe 31 PID 2504 wrote to memory of 2624 2504 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe 31 PID 2188 wrote to memory of 2528 2188 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe 32 PID 2188 wrote to memory of 2528 2188 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe 32 PID 2188 wrote to memory of 2528 2188 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe 32 PID 2188 wrote to memory of 2528 2188 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe 32 - System policy modification 1 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe"C:\Users\Admin\AppData\Local\Temp\9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c pause3⤵PID:2528
-
-
-
C:\Users\Admin\AppData\Local\Temp\9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe\\?\C:\Users\Admin\AppData\Local\Temp\9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe -network2⤵
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c pause3⤵PID:2624
-
-