4a4ba0934936df0b796b0c03690609b6596ccda0f434b59d5faea600157bc85f

General

Target
229bc019bf32a2f8e5451f11fa9eedff.exe
Size 842KB
Sample210522-kk2vb42dxe
SHA256 4a4ba0934936df0b796b0c03690609b6596ccda0f434b59d5faea600157bc85f
MD5 229bc019bf32a2f8e5451f11fa9eedff
SHA1 56d69a0f7c52f5f000a581180d23f6eb799915fc
SHA512 9326e11f47c2af8c34cd0688e020c233a408705cc207cd6f7f3d1896885b2dcb7fccb8d4970f33f8ca0831017e2d4d24e48d3372789a7dd998f2a66cc0ea1f78
MD5 SHA1 SHA512

Score

7^/10

discovery persistence

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2856	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\53b4cc6d-7b61-41c9-8c5c-29ff4e05a323\\229bc019bf32a2f8e5451f11fa9eedff.exe\" --AutoStart"	229bc019bf32a2f8e5451f11fa9eedff.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	api.2ip.ua
11	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 584 set thread context of 3584	584	229bc019bf32a2f8e5451f11fa9eedff.exe	77
PID 1020 set thread context of 2144	1020	229bc019bf32a2f8e5451f11fa9eedff.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3584	229bc019bf32a2f8e5451f11fa9eedff.exe
3584	229bc019bf32a2f8e5451f11fa9eedff.exe
2144	229bc019bf32a2f8e5451f11fa9eedff.exe
2144	229bc019bf32a2f8e5451f11fa9eedff.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 584 wrote to memory of 3584	584	229bc019bf32a2f8e5451f11fa9eedff.exe	77
PID 584 wrote to memory of 3584	584	229bc019bf32a2f8e5451f11fa9eedff.exe	77
PID 584 wrote to memory of 3584	584	229bc019bf32a2f8e5451f11fa9eedff.exe	77
PID 584 wrote to memory of 3584	584	229bc019bf32a2f8e5451f11fa9eedff.exe	77
PID 584 wrote to memory of 3584	584	229bc019bf32a2f8e5451f11fa9eedff.exe	77
PID 584 wrote to memory of 3584	584	229bc019bf32a2f8e5451f11fa9eedff.exe	77
PID 584 wrote to memory of 3584	584	229bc019bf32a2f8e5451f11fa9eedff.exe	77
PID 584 wrote to memory of 3584	584	229bc019bf32a2f8e5451f11fa9eedff.exe	77
PID 584 wrote to memory of 3584	584	229bc019bf32a2f8e5451f11fa9eedff.exe	77
PID 584 wrote to memory of 3584	584	229bc019bf32a2f8e5451f11fa9eedff.exe	77
PID 3584 wrote to memory of 2856	3584	229bc019bf32a2f8e5451f11fa9eedff.exe	79
PID 3584 wrote to memory of 2856	3584	229bc019bf32a2f8e5451f11fa9eedff.exe	79
PID 3584 wrote to memory of 2856	3584	229bc019bf32a2f8e5451f11fa9eedff.exe	79
PID 3584 wrote to memory of 1020	3584	229bc019bf32a2f8e5451f11fa9eedff.exe	80
PID 3584 wrote to memory of 1020	3584	229bc019bf32a2f8e5451f11fa9eedff.exe	80
PID 3584 wrote to memory of 1020	3584	229bc019bf32a2f8e5451f11fa9eedff.exe	80
PID 1020 wrote to memory of 2144	1020	229bc019bf32a2f8e5451f11fa9eedff.exe	82
PID 1020 wrote to memory of 2144	1020	229bc019bf32a2f8e5451f11fa9eedff.exe	82
PID 1020 wrote to memory of 2144	1020	229bc019bf32a2f8e5451f11fa9eedff.exe	82
PID 1020 wrote to memory of 2144	1020	229bc019bf32a2f8e5451f11fa9eedff.exe	82
PID 1020 wrote to memory of 2144	1020	229bc019bf32a2f8e5451f11fa9eedff.exe	82
PID 1020 wrote to memory of 2144	1020	229bc019bf32a2f8e5451f11fa9eedff.exe	82
PID 1020 wrote to memory of 2144	1020	229bc019bf32a2f8e5451f11fa9eedff.exe	82
PID 1020 wrote to memory of 2144	1020	229bc019bf32a2f8e5451f11fa9eedff.exe	82
PID 1020 wrote to memory of 2144	1020	229bc019bf32a2f8e5451f11fa9eedff.exe	82
PID 1020 wrote to memory of 2144	1020	229bc019bf32a2f8e5451f11fa9eedff.exe	82

C:\Users\Admin\AppData\Local\Temp\229bc019bf32a2f8e5451f11fa9eedff.exe
"C:\Users\Admin\AppData\Local\Temp\229bc019bf32a2f8e5451f11fa9eedff.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:584
- C:\Users\Admin\AppData\Local\Temp\229bc019bf32a2f8e5451f11fa9eedff.exe
  "C:\Users\Admin\AppData\Local\Temp\229bc019bf32a2f8e5451f11fa9eedff.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\53b4cc6d-7b61-41c9-8c5c-29ff4e05a323" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:2856
- - C:\Users\Admin\AppData\Local\Temp\229bc019bf32a2f8e5451f11fa9eedff.exe
    "C:\Users\Admin\AppData\Local\Temp\229bc019bf32a2f8e5451f11fa9eedff.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1020
  - - C:\Users\Admin\AppData\Local\Temp\229bc019bf32a2f8e5451f11fa9eedff.exe
      "C:\Users\Admin\AppData\Local\Temp\229bc019bf32a2f8e5451f11fa9eedff.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/584-116-0x0000000002350000-0x000000000246B000-memory.dmp

Download

memory/2144-124-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3584-114-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3584-117-0x0000000000400000-0x0000000000537000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads