a6fad6eda99cf8a1097f5222d9183323be396ad6ae37e3dfc364d196cf7f64fd

General

Target
31dac136c58a578cd442f036cfdcff9c.exe
Size 837KB
Sample210523-1vbqsr48g2
SHA256 a6fad6eda99cf8a1097f5222d9183323be396ad6ae37e3dfc364d196cf7f64fd
MD5 31dac136c58a578cd442f036cfdcff9c
SHA1 a9626740d451b6250d34d588596147b7ba6cf3a6
SHA512 ce8fe6c4b631dc11338ed6cf86817e3dcb2696b343329c1e24e32d1c3e343ca705ffa4905cc0cfc22fb43368c776e02621e59400e04d48dca0927abb27744415
MD5 SHA1 SHA512

Score

7^/10

discovery persistence

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1256	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\0081da30-6c82-4123-9d88-dff0a51e7ac5\\31dac136c58a578cd442f036cfdcff9c.exe\" --AutoStart"	31dac136c58a578cd442f036cfdcff9c.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	api.2ip.ua
13	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 860 set thread context of 500	860	31dac136c58a578cd442f036cfdcff9c.exe	77
PID 3396 set thread context of 3648	3396	31dac136c58a578cd442f036cfdcff9c.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
500	31dac136c58a578cd442f036cfdcff9c.exe
500	31dac136c58a578cd442f036cfdcff9c.exe
3648	31dac136c58a578cd442f036cfdcff9c.exe
3648	31dac136c58a578cd442f036cfdcff9c.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 500	860	31dac136c58a578cd442f036cfdcff9c.exe	77
PID 860 wrote to memory of 500	860	31dac136c58a578cd442f036cfdcff9c.exe	77
PID 860 wrote to memory of 500	860	31dac136c58a578cd442f036cfdcff9c.exe	77
PID 860 wrote to memory of 500	860	31dac136c58a578cd442f036cfdcff9c.exe	77
PID 860 wrote to memory of 500	860	31dac136c58a578cd442f036cfdcff9c.exe	77
PID 860 wrote to memory of 500	860	31dac136c58a578cd442f036cfdcff9c.exe	77
PID 860 wrote to memory of 500	860	31dac136c58a578cd442f036cfdcff9c.exe	77
PID 860 wrote to memory of 500	860	31dac136c58a578cd442f036cfdcff9c.exe	77
PID 860 wrote to memory of 500	860	31dac136c58a578cd442f036cfdcff9c.exe	77
PID 860 wrote to memory of 500	860	31dac136c58a578cd442f036cfdcff9c.exe	77
PID 500 wrote to memory of 1256	500	31dac136c58a578cd442f036cfdcff9c.exe	79
PID 500 wrote to memory of 1256	500	31dac136c58a578cd442f036cfdcff9c.exe	79
PID 500 wrote to memory of 1256	500	31dac136c58a578cd442f036cfdcff9c.exe	79
PID 500 wrote to memory of 3396	500	31dac136c58a578cd442f036cfdcff9c.exe	80
PID 500 wrote to memory of 3396	500	31dac136c58a578cd442f036cfdcff9c.exe	80
PID 500 wrote to memory of 3396	500	31dac136c58a578cd442f036cfdcff9c.exe	80
PID 3396 wrote to memory of 3648	3396	31dac136c58a578cd442f036cfdcff9c.exe	82
PID 3396 wrote to memory of 3648	3396	31dac136c58a578cd442f036cfdcff9c.exe	82
PID 3396 wrote to memory of 3648	3396	31dac136c58a578cd442f036cfdcff9c.exe	82
PID 3396 wrote to memory of 3648	3396	31dac136c58a578cd442f036cfdcff9c.exe	82
PID 3396 wrote to memory of 3648	3396	31dac136c58a578cd442f036cfdcff9c.exe	82
PID 3396 wrote to memory of 3648	3396	31dac136c58a578cd442f036cfdcff9c.exe	82
PID 3396 wrote to memory of 3648	3396	31dac136c58a578cd442f036cfdcff9c.exe	82
PID 3396 wrote to memory of 3648	3396	31dac136c58a578cd442f036cfdcff9c.exe	82
PID 3396 wrote to memory of 3648	3396	31dac136c58a578cd442f036cfdcff9c.exe	82
PID 3396 wrote to memory of 3648	3396	31dac136c58a578cd442f036cfdcff9c.exe	82

C:\Users\Admin\AppData\Local\Temp\31dac136c58a578cd442f036cfdcff9c.exe
"C:\Users\Admin\AppData\Local\Temp\31dac136c58a578cd442f036cfdcff9c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:860
- C:\Users\Admin\AppData\Local\Temp\31dac136c58a578cd442f036cfdcff9c.exe
  "C:\Users\Admin\AppData\Local\Temp\31dac136c58a578cd442f036cfdcff9c.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:500
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\0081da30-6c82-4123-9d88-dff0a51e7ac5" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:1256
- - C:\Users\Admin\AppData\Local\Temp\31dac136c58a578cd442f036cfdcff9c.exe
    "C:\Users\Admin\AppData\Local\Temp\31dac136c58a578cd442f036cfdcff9c.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3396
  - - C:\Users\Admin\AppData\Local\Temp\31dac136c58a578cd442f036cfdcff9c.exe
      "C:\Users\Admin\AppData\Local\Temp\31dac136c58a578cd442f036cfdcff9c.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/500-115-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/500-117-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/860-114-0x0000000002420000-0x000000000253B000-memory.dmp

Download

memory/3648-124-0x0000000000400000-0x0000000000537000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads