a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa

General

Target

a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
Size

1009KB
MD5

69809adb0b51f8242d4d06a05f402fee
SHA1

e8a205b1c2495642f8d5274d786f671cb705c234
SHA256

a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa
SHA512

bff55a35306c25cd87b29e1a59e6a2aaeae0b3e30d205a4c83ab08b9076af80467c858de6c164569c355ae5f0ce669fd06d4a46218de74d3d6e670dc05da9190
SSDEEP

12288:fjNVA5CBW7pwQq1B6OgVr/FkveCBk9MIGqz8GuapXYhUv6OmWIitgTDbLdSPx:BVa9pnnr/65k6aoGlVBWDbLyx

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File created	\??\c:\recycle\desktop.ini	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
File opened (read-only)	\??\X:	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
File opened (read-only)	\??\G:	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
File opened (read-only)	\??\H:	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
File opened (read-only)	\??\L:	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
File opened (read-only)	\??\P:	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
File opened (read-only)	\??\U:	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
File opened (read-only)	\??\Q:	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
File opened (read-only)	\??\S:	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
File opened (read-only)	\??\Y:	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
File opened (read-only)	\??\A:	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
File opened (read-only)	\??\E:	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
File opened (read-only)	\??\K:	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
File opened (read-only)	\??\M:	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
File opened (read-only)	\??\N:	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
File opened (read-only)	\??\Z:	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
File opened (read-only)	\??\R:	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
File opened (read-only)	\??\V:	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
File opened (read-only)	\??\B:	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
File opened (read-only)	\??\I:	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
File opened (read-only)	\??\J:	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
File opened (read-only)	\??\O:	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
File opened (read-only)	\??\T:	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ÔËÐÐ¼«Æ·ÃÜÅÌ\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe\" \"%1\""	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\ÔËÐÐ¼«Æ·ÃÜÅÌ\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe\" \"%1\""	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ÔËÐÐ¼«Æ·ÃÜÅÌ\DefaultIcon	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ÔËÐÐ¼«Æ·ÃÜÅÌ\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe"	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ÔËÐÐ¼«Æ·ÃÜÅÌ	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ÔËÐÐ¼«Æ·ÃÜÅÌ\command	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\folder\shell\ÔËÐÐ¼«Æ·ÃÜÅÌ	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\ÔËÐÐ¼«Æ·ÃÜÅÌ\command	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
912	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
912	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
912	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
912	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
912	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
912	a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe

C:\Users\Admin\AppData\Local\Temp\a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe
"C:\Users\Admin\AppData\Local\Temp\a07f559ea5393a0a5648696f98237eae40c200cb2b81cd91351fd3a6b51080aa.exe"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\xp corona.ini

Filesize
13KB

MD5
403105643fee3bc1a8d0b2f286e4a0ca

SHA1
54ea42531a383f242c537fe35f09e5503f197a24

SHA256
b0c49e23adb522f9dc6e335e08c4ac590fecf5630cc25a58088ab71a3a12593b

SHA512
7873793f4d8567dfedbd73a9d944cbc464a56d5bcaca07111aa08257b8b57b87623e9fd762d15cda2502940d00cca837d64e312acdad8394c46aa19d7bdbef40

Download Submit
memory/912-0-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download
memory/912-366-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/912-368-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing