0923315fe2a01d21f8fc16265ccde3f30265da481068368d5fc6cbf49999ade9

General

Target
b705472385b1b39e399d0d829a898184.exe
Size 821KB
Sample210528-18rda1zmt2
SHA256 0923315fe2a01d21f8fc16265ccde3f30265da481068368d5fc6cbf49999ade9
MD5 b705472385b1b39e399d0d829a898184
SHA1 ab99543b030811438683a2d010cc67cfcef8a4f7
SHA512 a35c7b0be2a96d09df6551c73f5f412215f0df325e66777a1ccce76677f1884cf7cd3aa5cd03f04c9746ae9bbb3dddf060aaad383885d7e07616778f1e32519b
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2164	b705472385b1b39e399d0d829a898184.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3544	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\fd9cdf75-e13d-4d5e-a253-bed0d3ae0e0d\\b705472385b1b39e399d0d829a898184.exe\" --AutoStart"	b705472385b1b39e399d0d829a898184.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	api.2ip.ua
12	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 488 set thread context of 808	488	b705472385b1b39e399d0d829a898184.exe	77
PID 2680 set thread context of 1152	2680	b705472385b1b39e399d0d829a898184.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
808	b705472385b1b39e399d0d829a898184.exe
808	b705472385b1b39e399d0d829a898184.exe
1152	b705472385b1b39e399d0d829a898184.exe
1152	b705472385b1b39e399d0d829a898184.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 488 wrote to memory of 808	488	b705472385b1b39e399d0d829a898184.exe	77
PID 488 wrote to memory of 808	488	b705472385b1b39e399d0d829a898184.exe	77
PID 488 wrote to memory of 808	488	b705472385b1b39e399d0d829a898184.exe	77
PID 488 wrote to memory of 808	488	b705472385b1b39e399d0d829a898184.exe	77
PID 488 wrote to memory of 808	488	b705472385b1b39e399d0d829a898184.exe	77
PID 488 wrote to memory of 808	488	b705472385b1b39e399d0d829a898184.exe	77
PID 488 wrote to memory of 808	488	b705472385b1b39e399d0d829a898184.exe	77
PID 488 wrote to memory of 808	488	b705472385b1b39e399d0d829a898184.exe	77
PID 488 wrote to memory of 808	488	b705472385b1b39e399d0d829a898184.exe	77
PID 488 wrote to memory of 808	488	b705472385b1b39e399d0d829a898184.exe	77
PID 808 wrote to memory of 3544	808	b705472385b1b39e399d0d829a898184.exe	79
PID 808 wrote to memory of 3544	808	b705472385b1b39e399d0d829a898184.exe	79
PID 808 wrote to memory of 3544	808	b705472385b1b39e399d0d829a898184.exe	79
PID 808 wrote to memory of 2680	808	b705472385b1b39e399d0d829a898184.exe	80
PID 808 wrote to memory of 2680	808	b705472385b1b39e399d0d829a898184.exe	80
PID 808 wrote to memory of 2680	808	b705472385b1b39e399d0d829a898184.exe	80
PID 2680 wrote to memory of 1152	2680	b705472385b1b39e399d0d829a898184.exe	82
PID 2680 wrote to memory of 1152	2680	b705472385b1b39e399d0d829a898184.exe	82
PID 2680 wrote to memory of 1152	2680	b705472385b1b39e399d0d829a898184.exe	82
PID 2680 wrote to memory of 1152	2680	b705472385b1b39e399d0d829a898184.exe	82
PID 2680 wrote to memory of 1152	2680	b705472385b1b39e399d0d829a898184.exe	82
PID 2680 wrote to memory of 1152	2680	b705472385b1b39e399d0d829a898184.exe	82
PID 2680 wrote to memory of 1152	2680	b705472385b1b39e399d0d829a898184.exe	82
PID 2680 wrote to memory of 1152	2680	b705472385b1b39e399d0d829a898184.exe	82
PID 2680 wrote to memory of 1152	2680	b705472385b1b39e399d0d829a898184.exe	82
PID 2680 wrote to memory of 1152	2680	b705472385b1b39e399d0d829a898184.exe	82

C:\Users\Admin\AppData\Local\Temp\b705472385b1b39e399d0d829a898184.exe
"C:\Users\Admin\AppData\Local\Temp\b705472385b1b39e399d0d829a898184.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:488
- C:\Users\Admin\AppData\Local\Temp\b705472385b1b39e399d0d829a898184.exe
  "C:\Users\Admin\AppData\Local\Temp\b705472385b1b39e399d0d829a898184.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:808
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\fd9cdf75-e13d-4d5e-a253-bed0d3ae0e0d" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:3544
- - C:\Users\Admin\AppData\Local\Temp\b705472385b1b39e399d0d829a898184.exe
    "C:\Users\Admin\AppData\Local\Temp\b705472385b1b39e399d0d829a898184.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\b705472385b1b39e399d0d829a898184.exe
      "C:\Users\Admin\AppData\Local\Temp\b705472385b1b39e399d0d829a898184.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1152

C:\Users\Admin\AppData\Local\fd9cdf75-e13d-4d5e-a253-bed0d3ae0e0d\b705472385b1b39e399d0d829a898184.exe
C:\Users\Admin\AppData\Local\fd9cdf75-e13d-4d5e-a253-bed0d3ae0e0d\b705472385b1b39e399d0d829a898184.exe --Task
1⤵
- Executes dropped EXE
PID:2164

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/488-114-0x00000000023E0000-0x00000000024FB000-memory.dmp

Download

memory/808-115-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/808-117-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1152-124-0x0000000000400000-0x0000000000537000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads