53175f3740f1f83290cd7d21a6c867f2b2eaca2c69ab2c9896d5900ffbaeb9fe

General

Target
90b9d91ae99a0c22737e091a6ab73d93.exe
Size 838KB
Sample210528-98535dayfx
SHA256 53175f3740f1f83290cd7d21a6c867f2b2eaca2c69ab2c9896d5900ffbaeb9fe
MD5 90b9d91ae99a0c22737e091a6ab73d93
SHA1 2141ce61484351e56b2fc364e8b5931a9a6d910f
SHA512 95684b261eb4ec979e568e79b4bb9a2a494cb472eaca60c2c0fb33b362f2c44431feb0202fa3dd62a28c8e7c589dbd9d9901cf2c10570de25028ff84c066e0bb
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1360	90b9d91ae99a0c22737e091a6ab73d93.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3172	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\dd544ba6-de48-4538-8606-2fb9940ac633\\90b9d91ae99a0c22737e091a6ab73d93.exe\" --AutoStart"	90b9d91ae99a0c22737e091a6ab73d93.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	api.2ip.ua
12	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4044 set thread context of 3980	4044	90b9d91ae99a0c22737e091a6ab73d93.exe	77
PID 2320 set thread context of 2712	2320	90b9d91ae99a0c22737e091a6ab73d93.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3980	90b9d91ae99a0c22737e091a6ab73d93.exe
3980	90b9d91ae99a0c22737e091a6ab73d93.exe
2712	90b9d91ae99a0c22737e091a6ab73d93.exe
2712	90b9d91ae99a0c22737e091a6ab73d93.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 3980	4044	90b9d91ae99a0c22737e091a6ab73d93.exe	77
PID 4044 wrote to memory of 3980	4044	90b9d91ae99a0c22737e091a6ab73d93.exe	77
PID 4044 wrote to memory of 3980	4044	90b9d91ae99a0c22737e091a6ab73d93.exe	77
PID 4044 wrote to memory of 3980	4044	90b9d91ae99a0c22737e091a6ab73d93.exe	77
PID 4044 wrote to memory of 3980	4044	90b9d91ae99a0c22737e091a6ab73d93.exe	77
PID 4044 wrote to memory of 3980	4044	90b9d91ae99a0c22737e091a6ab73d93.exe	77
PID 4044 wrote to memory of 3980	4044	90b9d91ae99a0c22737e091a6ab73d93.exe	77
PID 4044 wrote to memory of 3980	4044	90b9d91ae99a0c22737e091a6ab73d93.exe	77
PID 4044 wrote to memory of 3980	4044	90b9d91ae99a0c22737e091a6ab73d93.exe	77
PID 4044 wrote to memory of 3980	4044	90b9d91ae99a0c22737e091a6ab73d93.exe	77
PID 3980 wrote to memory of 3172	3980	90b9d91ae99a0c22737e091a6ab73d93.exe	79
PID 3980 wrote to memory of 3172	3980	90b9d91ae99a0c22737e091a6ab73d93.exe	79
PID 3980 wrote to memory of 3172	3980	90b9d91ae99a0c22737e091a6ab73d93.exe	79
PID 3980 wrote to memory of 2320	3980	90b9d91ae99a0c22737e091a6ab73d93.exe	80
PID 3980 wrote to memory of 2320	3980	90b9d91ae99a0c22737e091a6ab73d93.exe	80
PID 3980 wrote to memory of 2320	3980	90b9d91ae99a0c22737e091a6ab73d93.exe	80
PID 2320 wrote to memory of 2712	2320	90b9d91ae99a0c22737e091a6ab73d93.exe	82
PID 2320 wrote to memory of 2712	2320	90b9d91ae99a0c22737e091a6ab73d93.exe	82
PID 2320 wrote to memory of 2712	2320	90b9d91ae99a0c22737e091a6ab73d93.exe	82
PID 2320 wrote to memory of 2712	2320	90b9d91ae99a0c22737e091a6ab73d93.exe	82
PID 2320 wrote to memory of 2712	2320	90b9d91ae99a0c22737e091a6ab73d93.exe	82
PID 2320 wrote to memory of 2712	2320	90b9d91ae99a0c22737e091a6ab73d93.exe	82
PID 2320 wrote to memory of 2712	2320	90b9d91ae99a0c22737e091a6ab73d93.exe	82
PID 2320 wrote to memory of 2712	2320	90b9d91ae99a0c22737e091a6ab73d93.exe	82
PID 2320 wrote to memory of 2712	2320	90b9d91ae99a0c22737e091a6ab73d93.exe	82
PID 2320 wrote to memory of 2712	2320	90b9d91ae99a0c22737e091a6ab73d93.exe	82

C:\Users\Admin\AppData\Local\Temp\90b9d91ae99a0c22737e091a6ab73d93.exe
"C:\Users\Admin\AppData\Local\Temp\90b9d91ae99a0c22737e091a6ab73d93.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Users\Admin\AppData\Local\Temp\90b9d91ae99a0c22737e091a6ab73d93.exe
  "C:\Users\Admin\AppData\Local\Temp\90b9d91ae99a0c22737e091a6ab73d93.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\dd544ba6-de48-4538-8606-2fb9940ac633" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:3172
- - C:\Users\Admin\AppData\Local\Temp\90b9d91ae99a0c22737e091a6ab73d93.exe
    "C:\Users\Admin\AppData\Local\Temp\90b9d91ae99a0c22737e091a6ab73d93.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\90b9d91ae99a0c22737e091a6ab73d93.exe
      "C:\Users\Admin\AppData\Local\Temp\90b9d91ae99a0c22737e091a6ab73d93.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2712

C:\Users\Admin\AppData\Local\dd544ba6-de48-4538-8606-2fb9940ac633\90b9d91ae99a0c22737e091a6ab73d93.exe
C:\Users\Admin\AppData\Local\dd544ba6-de48-4538-8606-2fb9940ac633\90b9d91ae99a0c22737e091a6ab73d93.exe --Task
1⤵
- Executes dropped EXE
PID:1360

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2712-124-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3980-115-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3980-117-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4044-114-0x0000000002210000-0x000000000232B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads