445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5

General

Target

445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5.exe
Size

4.7MB
MD5

d7b2818499d3fcbed74b54f15a4c5e4e
SHA1

e6984998ba69838b3e21e2b4f6026cd9a89d85d3
SHA256

445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5
SHA512

c27a7ffbe2bdb209540c7b077e19b6a20532f8794ad6b8de2eb5bbb8c01be392608b430ea5a19d4a2f69466f813be8bcde80879d56b1565cf6b22c917526fcfb
SSDEEP

98304:kf4EIDDHK9nhCbJzEaokXvLZw8jzcO/7KNQS8r7NL5j5tDo3STwK7zUFBVEWjnuf:Q4HKDQBKkXy+XWt815j5tDobSUFQINHO

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5.exe
File opened (read-only)	\??\E:	445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5.exe
File opened (read-only)	\??\H:	445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5.exe
File opened (read-only)	\??\I:	445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5.exe
File opened (read-only)	\??\J:	445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5.exe
File opened (read-only)	\??\M:	445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5.exe
File opened (read-only)	\??\P:	445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5.exe
File opened (read-only)	\??\R:	445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5.exe
File opened (read-only)	\??\W:	445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5.exe
File opened (read-only)	\??\X:	445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5.exe
File opened (read-only)	\??\B:	445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5.exe
File opened (read-only)	\??\V:	445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5.exe
File opened (read-only)	\??\N:	445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5.exe
File opened (read-only)	\??\Q:	445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5.exe
File opened (read-only)	\??\T:	445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5.exe
File opened (read-only)	\??\U:	445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5.exe
File opened (read-only)	\??\A:	445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5.exe
File opened (read-only)	\??\G:	445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5.exe
File opened (read-only)	\??\K:	445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5.exe
File opened (read-only)	\??\L:	445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5.exe
File opened (read-only)	\??\O:	445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5.exe
File opened (read-only)	\??\Y:	445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5.exe
File opened (read-only)	\??\Z:	445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5.exe

C:\Users\Admin\AppData\Local\Temp\445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5.exe
"C:\Users\Admin\AppData\Local\Temp\445115a9ecbf2868e08bb338889352ddf2f376ec5371af0fbec4f203f812c9a5.exe"
1⤵
- Enumerates connected drives
- Checks processor information in registry
- Enumerates system info in registry
PID:844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:1896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/844-0-0x0000000000400000-0x0000000000CB9000-memory.dmp

Filesize
8.7MB

Download
memory/844-1-0x0000000000F60000-0x0000000000F63000-memory.dmp

Filesize
12KB

Download
memory/844-2-0x0000000000400000-0x0000000000CB9000-memory.dmp

Filesize
8.7MB

Download
memory/844-3-0x0000000000401000-0x000000000053D000-memory.dmp

Filesize
1.2MB

Download
memory/844-4-0x0000000000400000-0x0000000000CB9000-memory.dmp

Filesize
8.7MB

Download
memory/844-5-0x0000000000400000-0x0000000000CB9000-memory.dmp

Filesize
8.7MB

Download
memory/844-6-0x0000000000400000-0x0000000000CB9000-memory.dmp

Filesize
8.7MB

Download
memory/844-7-0x0000000000400000-0x0000000000CB9000-memory.dmp

Filesize
8.7MB

Download
memory/844-8-0x0000000000400000-0x0000000000CB9000-memory.dmp

Filesize
8.7MB

Download
memory/844-9-0x0000000000401000-0x000000000053D000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads