13206272a53c01577cf0f74306f3b9f26ce2c37870c4ed680757f34fedca5f1a

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-03-2024 13:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1c16c9e891832147157ea71f1d73dc1.exe
Size

36KB
MD5

e1c16c9e891832147157ea71f1d73dc1
SHA1

3211ace65f942bfd5d641ee2584b0d1f198e5141
SHA256

13206272a53c01577cf0f74306f3b9f26ce2c37870c4ed680757f34fedca5f1a
SHA512

25dca6b2415c542448d52e3fab606fed5d84aaa88e7e3a1c2c782ccc0b8392bb05212a2e53c3e15c2c8bcf4a0ffceef4ad5807ead9a582eccc05a148f7fb8241
SSDEEP

768:i5vljGnBrf1/btwtzJpYtcg4N4qpHK0hUzlBuD/K:izjGnBrfLGQtchpq0hUrP

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	e1c16c9e891832147157ea71f1d73dc1.exe
File opened (read-only)	\??\R:	e1c16c9e891832147157ea71f1d73dc1.exe
File opened (read-only)	\??\G:	e1c16c9e891832147157ea71f1d73dc1.exe
File opened (read-only)	\??\H:	e1c16c9e891832147157ea71f1d73dc1.exe
File opened (read-only)	\??\I:	e1c16c9e891832147157ea71f1d73dc1.exe
File opened (read-only)	\??\N:	e1c16c9e891832147157ea71f1d73dc1.exe
File opened (read-only)	\??\U:	e1c16c9e891832147157ea71f1d73dc1.exe
File opened (read-only)	\??\V:	e1c16c9e891832147157ea71f1d73dc1.exe
File opened (read-only)	\??\Y:	e1c16c9e891832147157ea71f1d73dc1.exe
File opened (read-only)	\??\P:	e1c16c9e891832147157ea71f1d73dc1.exe
File opened (read-only)	\??\Q:	e1c16c9e891832147157ea71f1d73dc1.exe
File opened (read-only)	\??\S:	e1c16c9e891832147157ea71f1d73dc1.exe
File opened (read-only)	\??\W:	e1c16c9e891832147157ea71f1d73dc1.exe
File opened (read-only)	\??\X:	e1c16c9e891832147157ea71f1d73dc1.exe
File opened (read-only)	\??\Z:	e1c16c9e891832147157ea71f1d73dc1.exe
File opened (read-only)	\??\E:	e1c16c9e891832147157ea71f1d73dc1.exe
File opened (read-only)	\??\K:	e1c16c9e891832147157ea71f1d73dc1.exe
File opened (read-only)	\??\L:	e1c16c9e891832147157ea71f1d73dc1.exe
File opened (read-only)	\??\M:	e1c16c9e891832147157ea71f1d73dc1.exe
File opened (read-only)	\??\O:	e1c16c9e891832147157ea71f1d73dc1.exe
File opened (read-only)	\??\T:	e1c16c9e891832147157ea71f1d73dc1.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorer.ext	e1c16c9e891832147157ea71f1d73dc1.exe
File opened for modification	C:\Windows\Tasks\explorer.ext	e1c16c9e891832147157ea71f1d73dc1.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2940	e1c16c9e891832147157ea71f1d73dc1.exe
2940	e1c16c9e891832147157ea71f1d73dc1.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
468	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2940	e1c16c9e891832147157ea71f1d73dc1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2940	e1c16c9e891832147157ea71f1d73dc1.exe

C:\Users\Admin\AppData\Local\Temp\e1c16c9e891832147157ea71f1d73dc1.exe
"C:\Users\Admin\AppData\Local\Temp\e1c16c9e891832147157ea71f1d73dc1.exe"
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2940-0-0x0000000013150000-0x000000001324F000-memory.dmp

Filesize
1020KB

Download
memory/2940-5-0x0000000013150000-0x000000001324F000-memory.dmp

Filesize
1020KB

Download