9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7

General

Target

9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
Size

277KB
MD5

d037f5c167b01849d267696695a919ef
SHA1

457ae227d1b63f295afbe18b539ff3b258f44a32
SHA256

9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7
SHA512

dcfb23c34be7688c292376c605b38eab3087fccd42b3dcd1708062dfee63e972c01107db505c90dc4db2f982bb5ea54fe2f9df9227e87b996a0346d0ea4c9a21
SSDEEP

6144:6Z1gm4z+Rp4PCL8YM6c2G/FtmUPvo39UPdwNN4:6l4qnM6c26s39jNN4

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe

description pid process target process

PID 2188 created 1192 2188 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe Explorer.EXE

description	pid	process	target process
PID 2188 created 1192	2188	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe	Explorer.EXE

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe

description	ioc	process
File opened (read-only)	\??\P:	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
File opened (read-only)	\??\U:	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
File opened (read-only)	\??\Z:	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
File opened (read-only)	\??\A:	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
File opened (read-only)	\??\H:	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
File opened (read-only)	\??\N:	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
File opened (read-only)	\??\O:	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
File opened (read-only)	\??\B:	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
File opened (read-only)	\??\E:	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
File opened (read-only)	\??\M:	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
File opened (read-only)	\??\V:	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
File opened (read-only)	\??\Y:	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
File opened (read-only)	\??\G:	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
File opened (read-only)	\??\J:	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
File opened (read-only)	\??\L:	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
File opened (read-only)	\??\W:	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
File opened (read-only)	\??\S:	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
File opened (read-only)	\??\T:	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
File opened (read-only)	\??\X:	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
File opened (read-only)	\??\I:	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
File opened (read-only)	\??\K:	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
File opened (read-only)	\??\Q:	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
File opened (read-only)	\??\R:	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe

description	pid	process	target process
PID 2188 wrote to memory of 2504	2188	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
PID 2188 wrote to memory of 2504	2188	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
PID 2188 wrote to memory of 2504	2188	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
PID 2188 wrote to memory of 2504	2188	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
PID 2504 wrote to memory of 2624	2504	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe	cmd.exe
PID 2504 wrote to memory of 2624	2504	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe	cmd.exe
PID 2504 wrote to memory of 2624	2504	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe	cmd.exe
PID 2504 wrote to memory of 2624	2504	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe	cmd.exe
PID 2188 wrote to memory of 2528	2188	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe	cmd.exe
PID 2188 wrote to memory of 2528	2188	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe	cmd.exe
PID 2188 wrote to memory of 2528	2188	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe	cmd.exe
PID 2188 wrote to memory of 2528	2188	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe	cmd.exe

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

Processes:

9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1192
- C:\Users\Admin\AppData\Local\Temp\9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
  "C:\Users\Admin\AppData\Local\Temp\9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Enumerates connected drives
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2188
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c pause
    3⤵
    PID:2528
- C:\Users\Admin\AppData\Local\Temp\9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe
  \\?\C:\Users\Admin\AppData\Local\Temp\9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.exe -network
  2⤵
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2504
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c pause
    3⤵
    PID:2624