96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689

General

Target

96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
Size

8.0MB
MD5

7adbc88cecc85b1a5e96c63d3eff00e9
SHA1

907c7e9f9a487eabe435c67766c6176e8507c6c9
SHA256

96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689
SHA512

ca08e18c182af9f70dc512caf0257d3f023048593424dd7255d41bb2d71297beca779cd9c5ba827ce07431530d8ca1d8d7cf1078d7bdb8632279f4cc4634ca9e
SSDEEP

196608:mzO0zP4PSS50+aDQzw6Dqs/y+cNBKbQ4hrivR/yR4/WdZ0Nys:CO0TMHU69a+c684BARyrd+Is

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3108	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
File opened (read-only)	\??\T:	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
File opened (read-only)	\??\G:	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
File opened (read-only)	\??\H:	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
File opened (read-only)	\??\I:	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
File opened (read-only)	\??\J:	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
File opened (read-only)	\??\L:	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
File opened (read-only)	\??\S:	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
File opened (read-only)	\??\V:	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
File opened (read-only)	\??\W:	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
File opened (read-only)	\??\X:	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
File opened (read-only)	\??\Y:	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
File opened (read-only)	\??\E:	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
File opened (read-only)	\??\K:	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
File opened (read-only)	\??\M:	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
File opened (read-only)	\??\N:	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
File opened (read-only)	\??\O:	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
File opened (read-only)	\??\U:	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
File opened (read-only)	\??\Z:	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
File opened (read-only)	\??\B:	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
File opened (read-only)	\??\P:	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
File opened (read-only)	\??\Q:	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
File opened (read-only)	\??\R:	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
5004	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
5004	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
5004	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
5004	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
5004	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
3108	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
3108	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
3108	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
3108	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
3108	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 3108	5004	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe	95
PID 5004 wrote to memory of 3108	5004	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe	95
PID 5004 wrote to memory of 3108	5004	96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe	95

C:\Users\Admin\AppData\Local\Temp\96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
"C:\Users\Admin\AppData\Local\Temp\96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe"
1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5004
- C:\ÈÈÑª´«Ææ\96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
  C:\ÈÈÑª´«Ææ\96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\d0d42a6dee5a050ffcdea3cf2e4b9f38.tmp

Filesize
12B

MD5
6837724c314d40567b48f77e84c4a1fe

SHA1
fe40871082304b3876ee4aee6b3a6b67d9ad7e13

SHA256
8feeb29152b7a1ff207f5db2e48a383f118faed4f5e4cf3f7105122f14b3093f

SHA512
69009beb3b26a43f4c5d87497b7910bec5124fcaef5933b32290cd2139527dc4a892f85082ce2f5f5cb4f03ccc7048746f9b67034c66986bde0746fc740a9a81

Download Submit
C:\ÈÈÑª´«Ææ\96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689.exe

Filesize
8.0MB

MD5
7adbc88cecc85b1a5e96c63d3eff00e9

SHA1
907c7e9f9a487eabe435c67766c6176e8507c6c9

SHA256
96b272e90c61c968bbf5187a4e681aa87f55a01e21496c5b517e73f796550689

SHA512
ca08e18c182af9f70dc512caf0257d3f023048593424dd7255d41bb2d71297beca779cd9c5ba827ce07431530d8ca1d8d7cf1078d7bdb8632279f4cc4634ca9e

Download Submit
memory/3108-16-0x0000000000400000-0x0000000000B9D000-memory.dmp

Filesize
7.6MB

Download
memory/3108-9-0x0000000000400000-0x0000000000B9D000-memory.dmp

Filesize
7.6MB

Download
memory/3108-10-0x0000000000400000-0x0000000000B9D000-memory.dmp

Filesize
7.6MB

Download
memory/3108-21-0x0000000000400000-0x0000000000B9D000-memory.dmp

Filesize
7.6MB

Download
memory/3108-23-0x0000000000400000-0x0000000000B9D000-memory.dmp

Filesize
7.6MB

Download
memory/3108-24-0x0000000000400000-0x0000000000B9D000-memory.dmp

Filesize
7.6MB

Download
memory/5004-2-0x00000000004A8000-0x00000000004A9000-memory.dmp

Filesize
4KB

Download
memory/5004-12-0x0000000002900000-0x0000000002903000-memory.dmp

Filesize
12KB

Download
memory/5004-13-0x0000000000400000-0x0000000000B9D000-memory.dmp

Filesize
7.6MB

Download
memory/5004-0-0x0000000000400000-0x0000000000B9D000-memory.dmp

Filesize
7.6MB

Download
memory/5004-1-0x0000000002900000-0x0000000002903000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing