d5c4869ac09853b7b1ee3edc1575dcae6d8326ccfaca54ae471d92ce30303203

General

Target

cs17.exe
Size

368KB
MD5

5bccde27536512de8d40151be161c5ae
SHA1

592a78ed0f8c3ff2f9083ae83824abcf3c36beb8
SHA256

d5c4869ac09853b7b1ee3edc1575dcae6d8326ccfaca54ae471d92ce30303203
SHA512

2924320be24e68f42bcb2b838c8668b870e782792a067171b5920a84d78e3c3d84a79a420735cabc8c18846c510ba1c5d803339c80fe6f9742c686196edd1814

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

cs17.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	cs17.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	cs17.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	cs17.exe

Modifies registry class 20 IoCs

Processes:

cs17.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D173E10A-001D-4318-9822-8C97A8418482}	cs17.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cs17.ExternalNSHandler\ = "ExternalNSHandler"	cs17.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D173E10A-001D-4318-9822-8C97A8418482}\ProgID	cs17.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C453F21-396D-11D5-9734-70E252C10127}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cs17.exe"	cs17.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D173E10A-001D-4318-9822-8C97A8418482}\LocalServer32	cs17.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C453F21-396D-11D5-9734-70E252C10127}\ProgID	cs17.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cs17.eBookNSHandler\Clsid\ = "{9C453F21-396D-11D5-9734-70E252C10127}"	cs17.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D173E10A-001D-4318-9822-8C97A8418482}\ = "ExternalNSHandler"	cs17.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cs17.ExternalNSHandler\Clsid	cs17.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cs17.ExternalNSHandler\Clsid\ = "{D173E10A-001D-4318-9822-8C97A8418482}"	cs17.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C453F21-396D-11D5-9734-70E252C10127}\LocalServer32	cs17.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cs17.eBookNSHandler\Clsid	cs17.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cs17.eBookNSHandler	cs17.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cs17.eBookNSHandler\ = "eBookNSHandler"	cs17.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C453F21-396D-11D5-9734-70E252C10127}\ProgID\ = "cs17.eBookNSHandler"	cs17.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D173E10A-001D-4318-9822-8C97A8418482}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cs17.exe"	cs17.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cs17.ExternalNSHandler	cs17.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D173E10A-001D-4318-9822-8C97A8418482}\ProgID\ = "cs17.ExternalNSHandler"	cs17.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C453F21-396D-11D5-9734-70E252C10127}	cs17.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C453F21-396D-11D5-9734-70E252C10127}\ = "eBookNSHandler"	cs17.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

cs17.exe

pid process

1992 cs17.exe
1992 cs17.exe

pid	process
1992	cs17.exe
1992	cs17.exe

C:\Users\Admin\AppData\Local\Temp\cs17.exe
"C:\Users\Admin\AppData\Local\Temp\cs17.exe"
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1992

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1992-60-0x0000000075B31000-0x0000000075B33000-memory.dmp

Filesize
8KB

Download
memory/1992-61-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing