d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d

General

Target

d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
Size

308KB
MD5

8df1195087daa119e81fd0cc529c88e5
SHA1

52f743d2fa6fa607278dac4a2bf7a3c054252c9f
SHA256

d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d
SHA512

2d141a3d6879f7b39b69f3d4acf0ee5faa28d786fdb538daeabd834cff344647985eff48747cf5e8061eb583b72ca33741399be43e73c92bf4e9d8b06dd108b3
SSDEEP

6144:kk4DdotiH8um78UhQyZ72VQShKLzuTHDZnvU4lYgfg:r61m7rhQyZiBV4gf

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe

description pid process target process

PID 2160 created 1192 2160 d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe Explorer.EXE

description	pid	process	target process
PID 2160 created 1192	2160	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe	Explorer.EXE

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe

description	ioc	process
File opened (read-only)	\??\E:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\H:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\J:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\K:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\L:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\R:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\V:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\W:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\G:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\I:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\N:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\P:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\Q:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\S:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\A:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\M:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\U:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\X:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\B:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\O:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\T:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\Y:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\Z:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exed981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe

description	pid	process	target process
PID 2160 wrote to memory of 2536	2160	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
PID 2160 wrote to memory of 2536	2160	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
PID 2160 wrote to memory of 2536	2160	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
PID 2160 wrote to memory of 2536	2160	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
PID 2536 wrote to memory of 2528	2536	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe	cmd.exe
PID 2536 wrote to memory of 2528	2536	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe	cmd.exe
PID 2536 wrote to memory of 2528	2536	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe	cmd.exe
PID 2536 wrote to memory of 2528	2536	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe	cmd.exe
PID 2160 wrote to memory of 2660	2160	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe	cmd.exe
PID 2160 wrote to memory of 2660	2160	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe	cmd.exe
PID 2160 wrote to memory of 2660	2160	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe	cmd.exe
PID 2160 wrote to memory of 2660	2160	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe	cmd.exe

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

Processes:

d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exed981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1192
- C:\Users\Admin\AppData\Local\Temp\d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
  "C:\Users\Admin\AppData\Local\Temp\d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Enumerates connected drives
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2160
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c pause
    3⤵
    PID:2660
- C:\Users\Admin\AppData\Local\Temp\d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
  \\?\C:\Users\Admin\AppData\Local\Temp\d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe -network
  2⤵
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2536
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c pause
    3⤵
    PID:2528