2f0c397eaa8ea5cfb225648954f4e9e0278876846f2d8d67f983be0f19c71a82

General

Target

ba7e7f269cce0a3f0224c28371dd54c0N.exe
Size

1.5MB
MD5

ba7e7f269cce0a3f0224c28371dd54c0
SHA1

c4f7d9bea19e6614e07d499aef0ee85726a7dfe3
SHA256

2f0c397eaa8ea5cfb225648954f4e9e0278876846f2d8d67f983be0f19c71a82
SHA512

401a9fd9aba801d6864be40ae8f4c399b48c7c8334d3e890dada151ebe2c24c4ec6a9634a58fa7cdb4d774fdf838c08431d16f9be6d7fbed44ff838edaf924d6
SSDEEP

6144:zJuXtXxog5E+FWPNfrf6yGEssQxNpbMceWdbjMMqcXmr8MMtjyhX9+FL:98XNE+FuNfrSyGEssQJy03MMq/r8MMP

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 10 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	ba7e7f269cce0a3f0224c28371dd54c0N.exe
File opened (read-only)	\??\I:	ba7e7f269cce0a3f0224c28371dd54c0N.exe
File opened (read-only)	\??\J:	ba7e7f269cce0a3f0224c28371dd54c0N.exe
File opened (read-only)	\??\K:	ba7e7f269cce0a3f0224c28371dd54c0N.exe
File opened (read-only)	\??\M:	ba7e7f269cce0a3f0224c28371dd54c0N.exe
File opened (read-only)	\??\G:	ba7e7f269cce0a3f0224c28371dd54c0N.exe
File opened (read-only)	\??\H:	ba7e7f269cce0a3f0224c28371dd54c0N.exe
File opened (read-only)	\??\L:	ba7e7f269cce0a3f0224c28371dd54c0N.exe
File opened (read-only)	\??\N:	ba7e7f269cce0a3f0224c28371dd54c0N.exe
File opened (read-only)	\??\O:	ba7e7f269cce0a3f0224c28371dd54c0N.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\7z.exe	ba7e7f269cce0a3f0224c28371dd54c0N.exe
File opened for modification	C:\Program Files\7-Zip\RCXEBAA.tmp	ba7e7f269cce0a3f0224c28371dd54c0N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXEBCD.tmp	ba7e7f269cce0a3f0224c28371dd54c0N.exe
File opened for modification	C:\Program Files\7-Zip\RCXEBBD.tmp	ba7e7f269cce0a3f0224c28371dd54c0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab	ba7e7f269cce0a3f0224c28371dd54c0N.exe
File created	C:\Program Files\7-Zip\7z.cab	ba7e7f269cce0a3f0224c28371dd54c0N.exe
File opened for modification	C:\Program Files\7-Zip\7z.cab	ba7e7f269cce0a3f0224c28371dd54c0N.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	ba7e7f269cce0a3f0224c28371dd54c0N.exe
File created	C:\Program Files\7-Zip\7zFM.cab	ba7e7f269cce0a3f0224c28371dd54c0N.exe
File created	C:\Program Files\7-Zip\7zFM.exe	ba7e7f269cce0a3f0224c28371dd54c0N.exe
File opened for modification	C:\Program Files\7-Zip\RCXEBBB.tmp	ba7e7f269cce0a3f0224c28371dd54c0N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab	ba7e7f269cce0a3f0224c28371dd54c0N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	ba7e7f269cce0a3f0224c28371dd54c0N.exe
File created	C:\Program Files\readme.1xt	ba7e7f269cce0a3f0224c28371dd54c0N.exe
File opened for modification	C:\Program Files\7-Zip\RCXEB69.tmp	ba7e7f269cce0a3f0224c28371dd54c0N.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	ba7e7f269cce0a3f0224c28371dd54c0N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXEBDE.tmp	ba7e7f269cce0a3f0224c28371dd54c0N.exe
File opened for modification	C:\Program Files\7-Zip\RCXEB6A.tmp	ba7e7f269cce0a3f0224c28371dd54c0N.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.cab	ba7e7f269cce0a3f0224c28371dd54c0N.exe
File opened for modification	C:\Program Files\7-Zip\RCXEBBC.tmp	ba7e7f269cce0a3f0224c28371dd54c0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	ba7e7f269cce0a3f0224c28371dd54c0N.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4892	2776	WerFault.exe	82

C:\Users\Admin\AppData\Local\Temp\ba7e7f269cce0a3f0224c28371dd54c0N.exe
"C:\Users\Admin\AppData\Local\Temp\ba7e7f269cce0a3f0224c28371dd54c0N.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
PID:2776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 736
  2⤵
  - Program crash
  PID:4892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2776 -ip 2776
1⤵
PID:1044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.cab

Filesize
544KB

MD5
9a1dd1d96481d61934dcc2d568971d06

SHA1
f136ef9bf8bd2fc753292fb5b7cf173a22675fb3

SHA256
8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525

SHA512
7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
217KB

MD5
5f5c2edbd8b444df55e7c5df0605b1ab

SHA1
5007aa1966990ff3773552e0ef8bfff43d9d9a95

SHA256
9f901bc50ae39716dd6ecab41bb338fc3786c93d7203219acc2087da90a41e84

SHA512
576064f0dd7c3e061a47b9a5a275e1cf7ca6ce07d046ae2a01add9ecdcbaa18e1ee5d2cf51b14ef24ef58685290cf1e13b6a31de4ca6e2c7e94e095c75f8fb36

Download Submit
C:\Program Files\7-Zip\7zFM.cab

Filesize
930KB

MD5
30ac0b832d75598fb3ec37b6f2a8c86a

SHA1
6f47dbfd6ff36df7ba581a4cef024da527dc3046

SHA256
1ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74

SHA512
505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.5MB

MD5
a2352e4a7a866c6c0a444097ede64f9f

SHA1
03fcb1b55729ee1134370b83eb0995b2d511f927

SHA256
42e0ce2347b4d6e540c1732138e37fc5e44fe7efe5cc56e178b0424a3766aa21

SHA512
d8b78e5f35d7ec43111f839fc9e5ecb55750a422e045caff35b136b1035580058286306f6a9ff30b2dfd76adcc90882ed2578e61c50f3d7ae48072e5e642f518

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab

Filesize
2.1MB

MD5
b8d69fa2755c3ab1f12f8866a8e2a4f7

SHA1
8e3cdfb20e158c2906323ba0094a18c7dd2aaf2d

SHA256
7e0976036431640ae1d9f1c0b52bcea5dd37ef86cd3f5304dc8a96459d9483cd

SHA512
5acac46068b331216978500f67a7fa5257bc5b05133fab6d88280b670ae4885ef2d5d1f531169b66bf1952e082f56b1ad2bc3901479b740f96c53ea405adda18

Download Submit
memory/2776-0-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2776-66-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download

Analysis

Sharing