46dc49be65d7165e2a6009854a4f27f0088230199e61e0555cb1bd266535874a

Analysis

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 7 IoCs

Processes:

9cde71abfd2a6aeb83cdd233cbc04fcd.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Conino\Nino\slonizo.to	9cde71abfd2a6aeb83cdd233cbc04fcd.exe
File opened for modification	C:\Program Files (x86)\Conino\Nino\siski_masiski.ri	9cde71abfd2a6aeb83cdd233cbc04fcd.exe
File opened for modification	C:\Program Files (x86)\Conino\Nino\turtsia.bat	9cde71abfd2a6aeb83cdd233cbc04fcd.exe
File opened for modification	C:\Program Files (x86)\Conino\Nino\Uninstall.exe	9cde71abfd2a6aeb83cdd233cbc04fcd.exe
File created	C:\Program Files (x86)\Conino\Nino\Uninstall.ini	9cde71abfd2a6aeb83cdd233cbc04fcd.exe
File opened for modification	C:\Program Files (x86)\Conino\Nino\soex.vbs	9cde71abfd2a6aeb83cdd233cbc04fcd.exe
File opened for modification	C:\Program Files (x86)\Conino\Nino\just_do_iti.vbs	9cde71abfd2a6aeb83cdd233cbc04fcd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

cmd.exe

pid process

812 cmd.exe

pid	process
812	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

9cde71abfd2a6aeb83cdd233cbc04fcd.exe

description	pid	process	target process
PID 880 wrote to memory of 812	880	9cde71abfd2a6aeb83cdd233cbc04fcd.exe	cmd.exe
PID 880 wrote to memory of 812	880	9cde71abfd2a6aeb83cdd233cbc04fcd.exe	cmd.exe
PID 880 wrote to memory of 812	880	9cde71abfd2a6aeb83cdd233cbc04fcd.exe	cmd.exe
PID 880 wrote to memory of 812	880	9cde71abfd2a6aeb83cdd233cbc04fcd.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\foo\9cde71abfd2a6aeb83cdd233cbc04fcd.exe
"C:\Users\Admin\AppData\Local\Temp\foo\9cde71abfd2a6aeb83cdd233cbc04fcd.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files (x86)\Conino\Nino\turtsia.bat" "
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:812

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Program Files (x86)\Conino\Nino\turtsia.bat

MD5
b9fcbdfb7319e755b725343e7a7c917b

SHA1
9ebd12b9eaef93e368ddd2b669913a5ba61b85f2

SHA256
318475285664e57167a7c0f741e5bed2dafcca03fd3ae0532b22b3649d1cda70

SHA512
f46c558e16da8816b80ed0602557cec5587e4c4282fcfab7d946e05fe6568b0dd09faa77f82c394699e62dbff3bd40837cdd17a61cc68d5888cfed29aef64e9f

Download Submit
memory/812-0-0x0000000000000000-mapping.dmp

Download