bfd0a32e6c664ddce985d1768b6a776b174e3b1e55aec8a49171f948e815509d

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 15:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bfd0a32e6c664ddce985d1768b6a776b174e3b1e55aec8a49171f948e815509d.exe
Size

9.9MB
MD5

35a54964d75ebf04fe3cda978cad874c
SHA1

63f43b5d0b11ffbed8783122723a80da5ce9deb2
SHA256

bfd0a32e6c664ddce985d1768b6a776b174e3b1e55aec8a49171f948e815509d
SHA512

0560469c0f1b0bb9de2dd2770f29168d69ca67e2997b84fb7e8bd150e7a6d9a8bbf2c8fa27bf1501d60c291ef7d4d6f7b3ea39e1b0b6b52d0da0ad01beae3623
SSDEEP

196608:/Lmyl1BLelbFZHKVrsEyi80+gmxgMN4HH8S0arS:zRPZqSp0gqNU8S0aG

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	bfd0a32e6c664ddce985d1768b6a776b174e3b1e55aec8a49171f948e815509d.exe
File opened (read-only)	\??\A:	bfd0a32e6c664ddce985d1768b6a776b174e3b1e55aec8a49171f948e815509d.exe
File opened (read-only)	\??\H:	bfd0a32e6c664ddce985d1768b6a776b174e3b1e55aec8a49171f948e815509d.exe
File opened (read-only)	\??\J:	bfd0a32e6c664ddce985d1768b6a776b174e3b1e55aec8a49171f948e815509d.exe
File opened (read-only)	\??\M:	bfd0a32e6c664ddce985d1768b6a776b174e3b1e55aec8a49171f948e815509d.exe
File opened (read-only)	\??\P:	bfd0a32e6c664ddce985d1768b6a776b174e3b1e55aec8a49171f948e815509d.exe
File opened (read-only)	\??\Q:	bfd0a32e6c664ddce985d1768b6a776b174e3b1e55aec8a49171f948e815509d.exe
File opened (read-only)	\??\S:	bfd0a32e6c664ddce985d1768b6a776b174e3b1e55aec8a49171f948e815509d.exe
File opened (read-only)	\??\X:	bfd0a32e6c664ddce985d1768b6a776b174e3b1e55aec8a49171f948e815509d.exe
File opened (read-only)	\??\L:	bfd0a32e6c664ddce985d1768b6a776b174e3b1e55aec8a49171f948e815509d.exe
File opened (read-only)	\??\O:	bfd0a32e6c664ddce985d1768b6a776b174e3b1e55aec8a49171f948e815509d.exe
File opened (read-only)	\??\U:	bfd0a32e6c664ddce985d1768b6a776b174e3b1e55aec8a49171f948e815509d.exe
File opened (read-only)	\??\V:	bfd0a32e6c664ddce985d1768b6a776b174e3b1e55aec8a49171f948e815509d.exe
File opened (read-only)	\??\B:	bfd0a32e6c664ddce985d1768b6a776b174e3b1e55aec8a49171f948e815509d.exe
File opened (read-only)	\??\E:	bfd0a32e6c664ddce985d1768b6a776b174e3b1e55aec8a49171f948e815509d.exe
File opened (read-only)	\??\G:	bfd0a32e6c664ddce985d1768b6a776b174e3b1e55aec8a49171f948e815509d.exe
File opened (read-only)	\??\K:	bfd0a32e6c664ddce985d1768b6a776b174e3b1e55aec8a49171f948e815509d.exe
File opened (read-only)	\??\Z:	bfd0a32e6c664ddce985d1768b6a776b174e3b1e55aec8a49171f948e815509d.exe
File opened (read-only)	\??\W:	bfd0a32e6c664ddce985d1768b6a776b174e3b1e55aec8a49171f948e815509d.exe
File opened (read-only)	\??\I:	bfd0a32e6c664ddce985d1768b6a776b174e3b1e55aec8a49171f948e815509d.exe
File opened (read-only)	\??\N:	bfd0a32e6c664ddce985d1768b6a776b174e3b1e55aec8a49171f948e815509d.exe
File opened (read-only)	\??\R:	bfd0a32e6c664ddce985d1768b6a776b174e3b1e55aec8a49171f948e815509d.exe
File opened (read-only)	\??\T:	bfd0a32e6c664ddce985d1768b6a776b174e3b1e55aec8a49171f948e815509d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2480	bfd0a32e6c664ddce985d1768b6a776b174e3b1e55aec8a49171f948e815509d.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2480	bfd0a32e6c664ddce985d1768b6a776b174e3b1e55aec8a49171f948e815509d.exe
2480	bfd0a32e6c664ddce985d1768b6a776b174e3b1e55aec8a49171f948e815509d.exe

C:\Users\Admin\AppData\Local\Temp\bfd0a32e6c664ddce985d1768b6a776b174e3b1e55aec8a49171f948e815509d.exe
"C:\Users\Admin\AppData\Local\Temp\bfd0a32e6c664ddce985d1768b6a776b174e3b1e55aec8a49171f948e815509d.exe"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2480-0-0x0000000010000000-0x0000000010116000-memory.dmp

Filesize
1.1MB

Download
memory/2480-5-0x00000000036F0000-0x00000000036F1000-memory.dmp

Filesize
4KB

Download