23e6f529565d49cb513c1a946311f933416afbd474bdb69ec394e6f87e65ff39

General

Target

c0d85818d5282745ad3dc89440a9c11b.exe
Size

151KB
MD5

c0d85818d5282745ad3dc89440a9c11b
SHA1

09345748b97693be3037540c1833a0aac4dae3c4
SHA256

23e6f529565d49cb513c1a946311f933416afbd474bdb69ec394e6f87e65ff39
SHA512

1a0d62e2869190bddcb8094067307249641a66bd74b3814ef0d51c6096ff00e66bb48c3cb215adddbac10a86537f382798eff4b601f418309cae65e3038af8a1
SSDEEP

3072:2ckNHUjeZI2bKLqnDrExI5uhL4YQ0qMlydsNUmXYN:aNSeW2bKLoQ53Q0j0SNUz

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	c0d85818d5282745ad3dc89440a9c11b.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	c0d85818d5282745ad3dc89440a9c11b.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	c0d85818d5282745ad3dc89440a9c11b.exe
File opened (read-only)	\??\W:	c0d85818d5282745ad3dc89440a9c11b.exe
File opened (read-only)	\??\O:	c0d85818d5282745ad3dc89440a9c11b.exe
File opened (read-only)	\??\E:	c0d85818d5282745ad3dc89440a9c11b.exe
File opened (read-only)	\??\M:	c0d85818d5282745ad3dc89440a9c11b.exe
File opened (read-only)	\??\K:	c0d85818d5282745ad3dc89440a9c11b.exe
File opened (read-only)	\??\G:	c0d85818d5282745ad3dc89440a9c11b.exe
File opened (read-only)	\??\Y:	c0d85818d5282745ad3dc89440a9c11b.exe
File opened (read-only)	\??\V:	c0d85818d5282745ad3dc89440a9c11b.exe
File opened (read-only)	\??\U:	c0d85818d5282745ad3dc89440a9c11b.exe
File opened (read-only)	\??\Q:	c0d85818d5282745ad3dc89440a9c11b.exe
File opened (read-only)	\??\T:	c0d85818d5282745ad3dc89440a9c11b.exe
File opened (read-only)	\??\P:	c0d85818d5282745ad3dc89440a9c11b.exe
File opened (read-only)	\??\N:	c0d85818d5282745ad3dc89440a9c11b.exe
File opened (read-only)	\??\H:	c0d85818d5282745ad3dc89440a9c11b.exe
File opened (read-only)	\??\J:	c0d85818d5282745ad3dc89440a9c11b.exe
File opened (read-only)	\??\I:	c0d85818d5282745ad3dc89440a9c11b.exe
File opened (read-only)	\??\X:	c0d85818d5282745ad3dc89440a9c11b.exe
File opened (read-only)	\??\S:	c0d85818d5282745ad3dc89440a9c11b.exe
File opened (read-only)	\??\R:	c0d85818d5282745ad3dc89440a9c11b.exe
File opened (read-only)	\??\L:	c0d85818d5282745ad3dc89440a9c11b.exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\CD Burning\autorun.inf	c0d85818d5282745ad3dc89440a9c11b.exe
File opened for modification	F:\autorun.inf	c0d85818d5282745ad3dc89440a9c11b.exe
File opened for modification	C:\autorun.inf	c0d85818d5282745ad3dc89440a9c11b.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\MSPUB.EXE	c0d85818d5282745ad3dc89440a9c11b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\OIS.EXE	c0d85818d5282745ad3dc89440a9c11b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\ONENOTE.EXE	c0d85818d5282745ad3dc89440a9c11b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\OUTLOOK.EXE	c0d85818d5282745ad3dc89440a9c11b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\EXCEL.EXE	c0d85818d5282745ad3dc89440a9c11b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\GROOVE.EXE	c0d85818d5282745ad3dc89440a9c11b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\INFOPATH.EXE	c0d85818d5282745ad3dc89440a9c11b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\MSACCESS.EXE	c0d85818d5282745ad3dc89440a9c11b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2596	3024	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3024	c0d85818d5282745ad3dc89440a9c11b.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2596	3024	c0d85818d5282745ad3dc89440a9c11b.exe	28
PID 3024 wrote to memory of 2596	3024	c0d85818d5282745ad3dc89440a9c11b.exe	28
PID 3024 wrote to memory of 2596	3024	c0d85818d5282745ad3dc89440a9c11b.exe	28
PID 3024 wrote to memory of 2596	3024	c0d85818d5282745ad3dc89440a9c11b.exe	28

C:\Users\Admin\AppData\Local\Temp\c0d85818d5282745ad3dc89440a9c11b.exe
"C:\Users\Admin\AppData\Local\Temp\c0d85818d5282745ad3dc89440a9c11b.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 560
  2⤵
  - Program crash
  PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

2

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\autorun.inf

Filesize
126B

MD5
163e20cbccefcdd42f46e43a94173c46

SHA1
4c7b5048e8608e2a75799e00ecf1bbb4773279ae

SHA256
7780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e

SHA512
e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8

Download Submit
C:\zPharaoh.exe

Filesize
151KB

MD5
c8d56c8a0470f12f144ac640e800f7df

SHA1
b9a0736d6a45c84215f8385cab348c31189017b3

SHA256
5dea4b9f845b14b74ddd1723727e9ebf1a67e0b28378e7671e3de1e8861edd32

SHA512
9e771803b4eebf60cbc0905d968cd38c4d7bd9be9f717b9f0c60c62ce09e11b6c6b4c8fb0e782bb6ebf0acbd28eef395ea30ad0784dbb2c16564d0dc123dd9bc

Download Submit
F:\zPharaoh.exe

Filesize
151KB

MD5
65632c5da62f4eca3beb962a4a995405

SHA1
4be8c531d0d07c46d0b0968f8cdd32cf23df96d9

SHA256
b78aef21472dcd78c78c4dc839ed1bac19986dad787f93c254dc1436b30a217a

SHA512
d7da54165edf89a5b0be64c6cb9e4a03f233223f087073c7721f2f2c70ad6e2c6c1bd872ccafd39ba8d89cee60c4666379a5db3f3b934a741d459b8c0d0de3e2

Download Submit
memory/3024-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads