43527bee3fff63468f0d88ceec297d842c86a206549957adbdf29266b3f17408

General

Target

43527bee3fff63468f0d88ceec297d842c86a206549957adbdf29266b3f17408.exe
Size

194KB
MD5

05ac242d2e2a432777bf0ab3a2247400
SHA1

e692b1d81d3b3436b34d626cf642d9cd95232e1c
SHA256

43527bee3fff63468f0d88ceec297d842c86a206549957adbdf29266b3f17408
SHA512

11d04cad8d6c5331f2b1c57f4bd3e2fac6ae5b3bea14768dfd28961dc9827d76533e2d3f4501d9c6bf3cfc52ff2525b5d7445bbb4f375797f655a82740d32c3c

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

Processes:

thunkadmin.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	thunkadmin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

thunkadmin.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	thunkadmin.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	thunkadmin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	thunkadmin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	thunkadmin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\32-e2-17-db-d2-77	thunkadmin.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = d021ec710b4ad701	thunkadmin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0"	thunkadmin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	thunkadmin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	thunkadmin.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionTime = d021ec710b4ad701	thunkadmin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecision = "0"	thunkadmin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1"	thunkadmin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	thunkadmin.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	thunkadmin.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	thunkadmin.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	thunkadmin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionReason = "1"	thunkadmin.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadNetworkName = "Network"	thunkadmin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77	thunkadmin.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070025000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	thunkadmin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}	thunkadmin.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

thunkadmin.exe

pid process

1532 thunkadmin.exe
1532 thunkadmin.exe
1532 thunkadmin.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

43527bee3fff63468f0d88ceec297d842c86a206549957adbdf29266b3f17408.exe

pid process

1708 43527bee3fff63468f0d88ceec297d842c86a206549957adbdf29266b3f17408.exe

pid	process
1532	thunkadmin.exe
1532	thunkadmin.exe
1532	thunkadmin.exe

pid	process
1708	43527bee3fff63468f0d88ceec297d842c86a206549957adbdf29266b3f17408.exe

Suspicious use of UnmapMainImage 4 IoCs

Processes:

43527bee3fff63468f0d88ceec297d842c86a206549957adbdf29266b3f17408.exe43527bee3fff63468f0d88ceec297d842c86a206549957adbdf29266b3f17408.exethunkadmin.exethunkadmin.exe

pid	process
1072	43527bee3fff63468f0d88ceec297d842c86a206549957adbdf29266b3f17408.exe
1708	43527bee3fff63468f0d88ceec297d842c86a206549957adbdf29266b3f17408.exe
1620	thunkadmin.exe
1532	thunkadmin.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

43527bee3fff63468f0d88ceec297d842c86a206549957adbdf29266b3f17408.exethunkadmin.exe

description	pid	process	target process
PID 1072 wrote to memory of 1708	1072	43527bee3fff63468f0d88ceec297d842c86a206549957adbdf29266b3f17408.exe	43527bee3fff63468f0d88ceec297d842c86a206549957adbdf29266b3f17408.exe
PID 1072 wrote to memory of 1708	1072	43527bee3fff63468f0d88ceec297d842c86a206549957adbdf29266b3f17408.exe	43527bee3fff63468f0d88ceec297d842c86a206549957adbdf29266b3f17408.exe
PID 1072 wrote to memory of 1708	1072	43527bee3fff63468f0d88ceec297d842c86a206549957adbdf29266b3f17408.exe	43527bee3fff63468f0d88ceec297d842c86a206549957adbdf29266b3f17408.exe
PID 1072 wrote to memory of 1708	1072	43527bee3fff63468f0d88ceec297d842c86a206549957adbdf29266b3f17408.exe	43527bee3fff63468f0d88ceec297d842c86a206549957adbdf29266b3f17408.exe
PID 1620 wrote to memory of 1532	1620	thunkadmin.exe	thunkadmin.exe
PID 1620 wrote to memory of 1532	1620	thunkadmin.exe	thunkadmin.exe
PID 1620 wrote to memory of 1532	1620	thunkadmin.exe	thunkadmin.exe
PID 1620 wrote to memory of 1532	1620	thunkadmin.exe	thunkadmin.exe

C:\Users\Admin\AppData\Local\Temp\43527bee3fff63468f0d88ceec297d842c86a206549957adbdf29266b3f17408.exe
"C:\Users\Admin\AppData\Local\Temp\43527bee3fff63468f0d88ceec297d842c86a206549957adbdf29266b3f17408.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Users\Admin\AppData\Local\Temp\43527bee3fff63468f0d88ceec297d842c86a206549957adbdf29266b3f17408.exe
  --b439a0a1
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of UnmapMainImage
  PID:1708

C:\Windows\SysWOW64\thunkadmin.exe
"C:\Windows\SysWOW64\thunkadmin.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\SysWOW64\thunkadmin.exe
  --1763ba43
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:1532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1072-60-0x00000000001B0000-0x00000000001CB000-memory.dmp

Filesize
108KB

Download
memory/1072-62-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1532-67-0x0000000000000000-mapping.dmp

Download
memory/1620-68-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1708-61-0x0000000000000000-mapping.dmp

Download
memory/1708-64-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1708-65-0x0000000075411000-0x0000000075413000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads