d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d

General

Target

d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
Size

308KB
MD5

8df1195087daa119e81fd0cc529c88e5
SHA1

52f743d2fa6fa607278dac4a2bf7a3c054252c9f
SHA256

d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d
SHA512

2d141a3d6879f7b39b69f3d4acf0ee5faa28d786fdb538daeabd834cff344647985eff48747cf5e8061eb583b72ca33741399be43e73c92bf4e9d8b06dd108b3
SSDEEP

6144:kk4DdotiH8um78UhQyZ72VQShKLzuTHDZnvU4lYgfg:r61m7rhQyZiBV4gf

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5060 created 3376	5060	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe	40

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\Q:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\S:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\U:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\Z:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\B:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\E:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\M:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\O:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\T:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\W:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\X:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\A:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\G:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\H:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\J:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\K:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\N:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\P:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\R:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\I:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\V:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
File opened (read-only)	\??\Y:	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 1860	5060	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe	99
PID 5060 wrote to memory of 1860	5060	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe	99
PID 5060 wrote to memory of 1860	5060	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe	99
PID 1860 wrote to memory of 3916	1860	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe	101
PID 1860 wrote to memory of 3916	1860	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe	101
PID 1860 wrote to memory of 3916	1860	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe	101
PID 5060 wrote to memory of 4252	5060	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe	104
PID 5060 wrote to memory of 4252	5060	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe	104
PID 5060 wrote to memory of 4252	5060	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe	104

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3376
- C:\Users\Admin\AppData\Local\Temp\d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
  "C:\Users\Admin\AppData\Local\Temp\d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Enumerates connected drives
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5060
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c pause
    3⤵
    PID:4252
- C:\Users\Admin\AppData\Local\Temp\d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe
  \\?\C:\Users\Admin\AppData\Local\Temp\d981fe00432dc5aa059884558c02276379f4cadbb7054c23962cb71122342b9d.exe -network
  2⤵
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1860
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c pause
    3⤵
    PID:3916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3952 --field-trial-handle=2264,i,7010714054498059916,1862725710331979271,262144 --variations-seed-version /prefetch:8
1⤵
PID:2256