d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0

General

Target

d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0.exe
Size

1.6MB
MD5

f4a1c0ecf68302a18374681e16c7ba12
SHA1

4878a89c6a08f0f612fe9ecf14de9c2ded28ca4d
SHA256

d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0
SHA512

741e44f17b226184c9834fd30ef6ed32211e10d642c04e7594b6c02c67c5b7cd5062c7ef5b65d22a2488b082c757b407a304c572e5b78cc245f4565b75088c6a
SSDEEP

24576:dZsJftyoenqgSl1+Jj2W1jHGkpVbbW+S3h:duVfezn2SjHGkfXW+S3h

Score

9^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral1/memory/1708-0-0x0000000000400000-0x0000000000592000-memory.dmp	UPX
behavioral1/memory/1708-367-0x0000000000400000-0x0000000000592000-memory.dmp	UPX

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File created	\??\c:\recycle\desktop.ini	d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0.exe
File opened (read-only)	\??\G:	d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0.exe
File opened (read-only)	\??\M:	d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0.exe
File opened (read-only)	\??\R:	d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0.exe
File opened (read-only)	\??\T:	d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0.exe
File opened (read-only)	\??\X:	d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0.exe
File opened (read-only)	\??\B:	d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0.exe
File opened (read-only)	\??\O:	d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0.exe
File opened (read-only)	\??\Q:	d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0.exe
File opened (read-only)	\??\S:	d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0.exe
File opened (read-only)	\??\U:	d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0.exe
File opened (read-only)	\??\Y:	d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0.exe
File opened (read-only)	\??\H:	d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0.exe
File opened (read-only)	\??\I:	d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0.exe
File opened (read-only)	\??\J:	d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0.exe
File opened (read-only)	\??\L:	d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0.exe
File opened (read-only)	\??\N:	d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0.exe
File opened (read-only)	\??\V:	d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0.exe
File opened (read-only)	\??\K:	d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0.exe
File opened (read-only)	\??\P:	d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0.exe
File opened (read-only)	\??\W:	d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0.exe
File opened (read-only)	\??\Z:	d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1708	d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1708	d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0.exe
1708	d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1708	d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0.exe
1708	d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1708	d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0.exe

C:\Users\Admin\AppData\Local\Temp\d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0.exe
"C:\Users\Admin\AppData\Local\Temp\d5062d1c4baf51695da752e1bc7eac5f28db9cf55d16baab659738c5df72edc0.exe"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\xp corona.ini

Filesize
13KB

MD5
403105643fee3bc1a8d0b2f286e4a0ca

SHA1
54ea42531a383f242c537fe35f09e5503f197a24

SHA256
b0c49e23adb522f9dc6e335e08c4ac590fecf5630cc25a58088ab71a3a12593b

SHA512
7873793f4d8567dfedbd73a9d944cbc464a56d5bcaca07111aa08257b8b57b87623e9fd762d15cda2502940d00cca837d64e312acdad8394c46aa19d7bdbef40

Download Submit
memory/1708-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1708-0-0x0000000000400000-0x0000000000592000-memory.dmp

Filesize
1.6MB

Download
memory/1708-368-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1708-367-0x0000000000400000-0x0000000000592000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing