5ec33fa1c0101afe476b1f09a59caa7a47ca7dcfd6ba6be9a992e1dcd74995d3

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38e5708d158ce5a25ff2ef323e54c550N.exe
Size

184KB
MD5

38e5708d158ce5a25ff2ef323e54c550
SHA1

40515f1312bb32754d06d7704f135abcf7cfa904
SHA256

5ec33fa1c0101afe476b1f09a59caa7a47ca7dcfd6ba6be9a992e1dcd74995d3
SHA512

33b53c2e59948b23330e6a3d2e7b82387b09e654c101eb881a35b5e72e6c5a0368b6fc7ca9ecf0aeb4e5d581e446d018fe847b3bec493f2b823dd0fa0ee7c38f
SSDEEP

1536:THSoNdVRsAXg993nNK6Y1Yu6nz50vVkdIJIfBNMo/9J/awOnkNQK3:7SsdVRsAXg7M1Y3nz520NMo/9l7NQK3

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4824	584.pif

Executes dropped EXE 1 IoCs

pid	Process
4824	584.pif

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	584.pif
File opened (read-only)	\??\U:	584.pif
File opened (read-only)	\??\W:	584.pif
File opened (read-only)	\??\Z:	584.pif
File opened (read-only)	\??\I:	584.pif
File opened (read-only)	\??\M:	584.pif
File opened (read-only)	\??\J:	584.pif
File opened (read-only)	\??\R:	584.pif
File opened (read-only)	\??\K:	584.pif
File opened (read-only)	\??\O:	584.pif
File opened (read-only)	\??\P:	584.pif
File opened (read-only)	\??\T:	584.pif
File opened (read-only)	\??\X:	584.pif
File opened (read-only)	\??\G:	584.pif
File opened (read-only)	\??\H:	584.pif
File opened (read-only)	\??\N:	584.pif
File opened (read-only)	\??\Q:	584.pif
File opened (read-only)	\??\V:	584.pif
File opened (read-only)	\??\Y:	584.pif
File opened (read-only)	\??\E:	584.pif
File opened (read-only)	\??\L:	584.pif

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\RCX75BF.tmp	584.pif
File opened for modification	C:\Windows\SysWOW64\RCX7261.tmp	584.pif
File opened for modification	C:\Windows\SysWOW64\calc.exe15724	584.pif
File opened for modification	C:\Windows\SysWOW64\RCX7427.tmp	584.pif
File opened for modification	C:\Windows\SysWOW64\notepad.exe11478	584.pif
File opened for modification	C:\Windows\SysWOW64\RCX766C.tmp	584.pif
File opened for modification	C:\Windows\SysWOW64\userinit.exe18467	584.pif
File opened for modification	C:\Windows\SysWOW64\RCX74C4.tmp	584.pif
File opened for modification	C:\Windows\SysWOW64\ctfmon.exe26962	584.pif
File opened for modification	C:\Windows\SysWOW64\cleanmgr.exe24464	584.pif

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	584.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	38e5708d158ce5a25ff2ef323e54c550N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 4824	3432	38e5708d158ce5a25ff2ef323e54c550N.exe	81
PID 3432 wrote to memory of 4824	3432	38e5708d158ce5a25ff2ef323e54c550N.exe	81
PID 3432 wrote to memory of 4824	3432	38e5708d158ce5a25ff2ef323e54c550N.exe	81

C:\Users\Admin\AppData\Local\Temp\38e5708d158ce5a25ff2ef323e54c550N.exe
"C:\Users\Admin\AppData\Local\Temp\38e5708d158ce5a25ff2ef323e54c550N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Users\Admin\AppData\Local\Temp\584.pif
  C:\Users\Admin\AppData\Local\Temp\584.pif ////DAEMON
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:4824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\584.pif

Filesize
184KB

MD5
38e5708d158ce5a25ff2ef323e54c550

SHA1
40515f1312bb32754d06d7704f135abcf7cfa904

SHA256
5ec33fa1c0101afe476b1f09a59caa7a47ca7dcfd6ba6be9a992e1dcd74995d3

SHA512
33b53c2e59948b23330e6a3d2e7b82387b09e654c101eb881a35b5e72e6c5a0368b6fc7ca9ecf0aeb4e5d581e446d018fe847b3bec493f2b823dd0fa0ee7c38f

Download Submit
C:\Windows\SysWOW64\userinit.exe18467

Filesize
211KB

MD5
9104622b6e703f5ea3133673a6548b49

SHA1
3b9487f390b450f448b944268538dcba9e86f4ca

SHA256
078ab500bf495869278acb15a2bc4e24e01cb5e5457b52738221669f6f157c09

SHA512
264cf8006df6e4914637bcba76038bef1601f7f99d76f0b7a1f75307512353ec61e65afd5496c8c7a81a5f229a7b62b6754499f0a97872b01f1ca158f448946f

Download Submit