4d54efae853bb657096c19ccab822849250af7a4051e60e3a1d44d0fb7f6502e

General

Target
7026b11c2f3116904b38e03a0b0ed706.exe
Size 843KB
Sample210526-n28jas54fa
SHA256 4d54efae853bb657096c19ccab822849250af7a4051e60e3a1d44d0fb7f6502e
MD5 7026b11c2f3116904b38e03a0b0ed706
SHA1 af7cf8f0cf541dbb8105b72bbc9d68f00440ee55
SHA512 236a4cfbf8cef7e05d66c64736de4e75832a54da1f819e2781d075fd02219b7a985e4ec66605d2d87e1401e09f54d568654d491bb1f76d148a9f7a57abdc44c5
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3868	7026b11c2f3116904b38e03a0b0ed706.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2404	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\f66a0617-d251-4cc5-8994-d9b712495d8e\\7026b11c2f3116904b38e03a0b0ed706.exe\" --AutoStart"	7026b11c2f3116904b38e03a0b0ed706.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	api.2ip.ua
13	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4068 set thread context of 3980	4068	7026b11c2f3116904b38e03a0b0ed706.exe	77
PID 1392 set thread context of 2704	1392	7026b11c2f3116904b38e03a0b0ed706.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3980	7026b11c2f3116904b38e03a0b0ed706.exe
3980	7026b11c2f3116904b38e03a0b0ed706.exe
2704	7026b11c2f3116904b38e03a0b0ed706.exe
2704	7026b11c2f3116904b38e03a0b0ed706.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 3980	4068	7026b11c2f3116904b38e03a0b0ed706.exe	77
PID 4068 wrote to memory of 3980	4068	7026b11c2f3116904b38e03a0b0ed706.exe	77
PID 4068 wrote to memory of 3980	4068	7026b11c2f3116904b38e03a0b0ed706.exe	77
PID 4068 wrote to memory of 3980	4068	7026b11c2f3116904b38e03a0b0ed706.exe	77
PID 4068 wrote to memory of 3980	4068	7026b11c2f3116904b38e03a0b0ed706.exe	77
PID 4068 wrote to memory of 3980	4068	7026b11c2f3116904b38e03a0b0ed706.exe	77
PID 4068 wrote to memory of 3980	4068	7026b11c2f3116904b38e03a0b0ed706.exe	77
PID 4068 wrote to memory of 3980	4068	7026b11c2f3116904b38e03a0b0ed706.exe	77
PID 4068 wrote to memory of 3980	4068	7026b11c2f3116904b38e03a0b0ed706.exe	77
PID 4068 wrote to memory of 3980	4068	7026b11c2f3116904b38e03a0b0ed706.exe	77
PID 3980 wrote to memory of 2404	3980	7026b11c2f3116904b38e03a0b0ed706.exe	79
PID 3980 wrote to memory of 2404	3980	7026b11c2f3116904b38e03a0b0ed706.exe	79
PID 3980 wrote to memory of 2404	3980	7026b11c2f3116904b38e03a0b0ed706.exe	79
PID 3980 wrote to memory of 1392	3980	7026b11c2f3116904b38e03a0b0ed706.exe	80
PID 3980 wrote to memory of 1392	3980	7026b11c2f3116904b38e03a0b0ed706.exe	80
PID 3980 wrote to memory of 1392	3980	7026b11c2f3116904b38e03a0b0ed706.exe	80
PID 1392 wrote to memory of 2704	1392	7026b11c2f3116904b38e03a0b0ed706.exe	82
PID 1392 wrote to memory of 2704	1392	7026b11c2f3116904b38e03a0b0ed706.exe	82
PID 1392 wrote to memory of 2704	1392	7026b11c2f3116904b38e03a0b0ed706.exe	82
PID 1392 wrote to memory of 2704	1392	7026b11c2f3116904b38e03a0b0ed706.exe	82
PID 1392 wrote to memory of 2704	1392	7026b11c2f3116904b38e03a0b0ed706.exe	82
PID 1392 wrote to memory of 2704	1392	7026b11c2f3116904b38e03a0b0ed706.exe	82
PID 1392 wrote to memory of 2704	1392	7026b11c2f3116904b38e03a0b0ed706.exe	82
PID 1392 wrote to memory of 2704	1392	7026b11c2f3116904b38e03a0b0ed706.exe	82
PID 1392 wrote to memory of 2704	1392	7026b11c2f3116904b38e03a0b0ed706.exe	82
PID 1392 wrote to memory of 2704	1392	7026b11c2f3116904b38e03a0b0ed706.exe	82

C:\Users\Admin\AppData\Local\Temp\7026b11c2f3116904b38e03a0b0ed706.exe
"C:\Users\Admin\AppData\Local\Temp\7026b11c2f3116904b38e03a0b0ed706.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Users\Admin\AppData\Local\Temp\7026b11c2f3116904b38e03a0b0ed706.exe
  "C:\Users\Admin\AppData\Local\Temp\7026b11c2f3116904b38e03a0b0ed706.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\f66a0617-d251-4cc5-8994-d9b712495d8e" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:2404
- - C:\Users\Admin\AppData\Local\Temp\7026b11c2f3116904b38e03a0b0ed706.exe
    "C:\Users\Admin\AppData\Local\Temp\7026b11c2f3116904b38e03a0b0ed706.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1392
  - - C:\Users\Admin\AppData\Local\Temp\7026b11c2f3116904b38e03a0b0ed706.exe
      "C:\Users\Admin\AppData\Local\Temp\7026b11c2f3116904b38e03a0b0ed706.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2704

C:\Users\Admin\AppData\Local\f66a0617-d251-4cc5-8994-d9b712495d8e\7026b11c2f3116904b38e03a0b0ed706.exe
C:\Users\Admin\AppData\Local\f66a0617-d251-4cc5-8994-d9b712495d8e\7026b11c2f3116904b38e03a0b0ed706.exe --Task
1⤵
- Executes dropped EXE
PID:3868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2704-124-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3980-115-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3980-117-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4068-114-0x0000000002220000-0x000000000233B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads