695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd

General

Target

695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe
Size

1.5MB
MD5

6e00bfc00b435588a6f091ef55c536c4
SHA1

06356a232e61250fbc37d390c74071596ad8c3e1
SHA256

695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd
SHA512

e8802dfa04073c6b7ceac128ee58467156964947ede8b17f2cccd078ce98f9d4c23c7b2ee97e08e4fb172aa7c0654fbde9f1973654b96776fad2f2e0f5984247
SSDEEP

6144:kJuXtXxog5E+FWPNfrf6yGEssQxNpbM2eWdbjMMqcXmr8MMtjyhX9+FL:w8XNE+FuNfrSyGEssQJU03MMq/r8MMP

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 10 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe
File opened (read-only)	\??\O:	695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe
File opened (read-only)	\??\G:	695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe
File opened (read-only)	\??\H:	695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe
File opened (read-only)	\??\I:	695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe
File opened (read-only)	\??\J:	695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe
File opened (read-only)	\??\K:	695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe
File opened (read-only)	\??\M:	695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe
File opened (read-only)	\??\E:	695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe
File opened (read-only)	\??\L:	695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\RCX4C2F.tmp	695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe
File created	C:\Program Files\readme.1xt	695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe
File created	C:\Program Files\7-Zip\7z.exe	695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe
File opened for modification	C:\Program Files\7-Zip\RCX4C1D.tmp	695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe
File created	C:\Program Files\7-Zip\7zFM.cab	695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.cab	695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe
File opened for modification	C:\Program Files\7-Zip\7z.cab	695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe
File opened for modification	C:\Program Files\7-Zip\RCX4C2E.tmp	695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe
File opened for modification	C:\Program Files\7-Zip\RCX4C3F.tmp	695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe
File opened for modification	C:\Program Files\7-Zip\RCX4C40.tmp	695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab	695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX4C51.tmp	695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX4C52.tmp	695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe
File created	C:\Program Files\7-Zip\7z.cab	695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe
File opened for modification	C:\Program Files\7-Zip\RCX4C1C.tmp	695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe
File created	C:\Program Files\7-Zip\7zFM.exe	695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab	695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3928	4864	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe
"C:\Users\Admin\AppData\Local\Temp\695d92b3560eb32a4b9c0cdba0bfabc26131c3c7e2de2e73a85979cb81a569fd.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
PID:4864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 680
  2⤵
  - Program crash
  PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4864 -ip 4864
1⤵
PID:1468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.cab

Filesize
544KB

MD5
9a1dd1d96481d61934dcc2d568971d06

SHA1
f136ef9bf8bd2fc753292fb5b7cf173a22675fb3

SHA256
8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525

SHA512
7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
1.5MB

MD5
3509a586b5ed933e4363b8cc4aa34fdd

SHA1
f92218e9f08cc48131de6fe4ead1cfd44374611c

SHA256
02eebc83ed87c9e72dca65e4da78a9de802c1329e789ef865c4498af1193d222

SHA512
de2c38499b22640a8f0a6f8993664119dc3fd939f6afe0d33765dd934fe65428d67c596e8e43e28728c225c54654b4c6d92529766c00a8ce72f7e8d6f343343a

Download Submit
C:\Program Files\7-Zip\7zFM.cab

Filesize
930KB

MD5
30ac0b832d75598fb3ec37b6f2a8c86a

SHA1
6f47dbfd6ff36df7ba581a4cef024da527dc3046

SHA256
1ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74

SHA512
505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX4C51.tmp

Filesize
174KB

MD5
8d9797194e3826b5ab1050f637275859

SHA1
e633cc82c5ae2f57aba7cf83738a592cff2a8fc9

SHA256
ed8e457251c983d7acdcd3dcbdf750d21509aa056e62fee6525034e1721941dd

SHA512
aaed0b4b27ecb5616d5967226c3d6e2b9aaaa432380747f8cc5c9b83659d1a72cc175fe0157359f3b622fba4e7b94bb4626726ed97150662d1f4ded0fbb1ab18

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab

Filesize
2.1MB

MD5
b8d69fa2755c3ab1f12f8866a8e2a4f7

SHA1
8e3cdfb20e158c2906323ba0094a18c7dd2aaf2d

SHA256
7e0976036431640ae1d9f1c0b52bcea5dd37ef86cd3f5304dc8a96459d9483cd

SHA512
5acac46068b331216978500f67a7fa5257bc5b05133fab6d88280b670ae4885ef2d5d1f531169b66bf1952e082f56b1ad2bc3901479b740f96c53ea405adda18

Download Submit
memory/4864-0-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4864-67-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing