129264dc4a2060710aafef169d4fb773f99f6fa7588e206591d55d69617e96fd

General

Target
068082355ea6c432c0773a43696180ac.exe
Size 866KB
Sample210529-2pgjsdc76a
SHA256 129264dc4a2060710aafef169d4fb773f99f6fa7588e206591d55d69617e96fd
MD5 068082355ea6c432c0773a43696180ac
SHA1 bf7348373b51748e141ff8ebc9cf43ff169e2973
SHA512 724a82b03234ddb4012123d5c7515ab4317e0aab0c93ffebd1495507422d7ebcc3604d12543819ef9461e9a94841cbe5a8948f29184ed8c40f2d2d68dcab2c76
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2316	068082355ea6c432c0773a43696180ac.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1964	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\0fedfd17-cc4c-4a69-8e1b-d0e4684ae72f\\068082355ea6c432c0773a43696180ac.exe\" --AutoStart"	068082355ea6c432c0773a43696180ac.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	api.2ip.ua
13	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 672 set thread context of 3136	672	068082355ea6c432c0773a43696180ac.exe	77
PID 3264 set thread context of 2288	3264	068082355ea6c432c0773a43696180ac.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3136	068082355ea6c432c0773a43696180ac.exe
3136	068082355ea6c432c0773a43696180ac.exe
2288	068082355ea6c432c0773a43696180ac.exe
2288	068082355ea6c432c0773a43696180ac.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 3136	672	068082355ea6c432c0773a43696180ac.exe	77
PID 672 wrote to memory of 3136	672	068082355ea6c432c0773a43696180ac.exe	77
PID 672 wrote to memory of 3136	672	068082355ea6c432c0773a43696180ac.exe	77
PID 672 wrote to memory of 3136	672	068082355ea6c432c0773a43696180ac.exe	77
PID 672 wrote to memory of 3136	672	068082355ea6c432c0773a43696180ac.exe	77
PID 672 wrote to memory of 3136	672	068082355ea6c432c0773a43696180ac.exe	77
PID 672 wrote to memory of 3136	672	068082355ea6c432c0773a43696180ac.exe	77
PID 672 wrote to memory of 3136	672	068082355ea6c432c0773a43696180ac.exe	77
PID 672 wrote to memory of 3136	672	068082355ea6c432c0773a43696180ac.exe	77
PID 672 wrote to memory of 3136	672	068082355ea6c432c0773a43696180ac.exe	77
PID 3136 wrote to memory of 1964	3136	068082355ea6c432c0773a43696180ac.exe	79
PID 3136 wrote to memory of 1964	3136	068082355ea6c432c0773a43696180ac.exe	79
PID 3136 wrote to memory of 1964	3136	068082355ea6c432c0773a43696180ac.exe	79
PID 3136 wrote to memory of 3264	3136	068082355ea6c432c0773a43696180ac.exe	80
PID 3136 wrote to memory of 3264	3136	068082355ea6c432c0773a43696180ac.exe	80
PID 3136 wrote to memory of 3264	3136	068082355ea6c432c0773a43696180ac.exe	80
PID 3264 wrote to memory of 2288	3264	068082355ea6c432c0773a43696180ac.exe	82
PID 3264 wrote to memory of 2288	3264	068082355ea6c432c0773a43696180ac.exe	82
PID 3264 wrote to memory of 2288	3264	068082355ea6c432c0773a43696180ac.exe	82
PID 3264 wrote to memory of 2288	3264	068082355ea6c432c0773a43696180ac.exe	82
PID 3264 wrote to memory of 2288	3264	068082355ea6c432c0773a43696180ac.exe	82
PID 3264 wrote to memory of 2288	3264	068082355ea6c432c0773a43696180ac.exe	82
PID 3264 wrote to memory of 2288	3264	068082355ea6c432c0773a43696180ac.exe	82
PID 3264 wrote to memory of 2288	3264	068082355ea6c432c0773a43696180ac.exe	82
PID 3264 wrote to memory of 2288	3264	068082355ea6c432c0773a43696180ac.exe	82
PID 3264 wrote to memory of 2288	3264	068082355ea6c432c0773a43696180ac.exe	82

C:\Users\Admin\AppData\Local\Temp\068082355ea6c432c0773a43696180ac.exe
"C:\Users\Admin\AppData\Local\Temp\068082355ea6c432c0773a43696180ac.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:672
- C:\Users\Admin\AppData\Local\Temp\068082355ea6c432c0773a43696180ac.exe
  "C:\Users\Admin\AppData\Local\Temp\068082355ea6c432c0773a43696180ac.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3136
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\0fedfd17-cc4c-4a69-8e1b-d0e4684ae72f" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:1964
- - C:\Users\Admin\AppData\Local\Temp\068082355ea6c432c0773a43696180ac.exe
    "C:\Users\Admin\AppData\Local\Temp\068082355ea6c432c0773a43696180ac.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3264
  - - C:\Users\Admin\AppData\Local\Temp\068082355ea6c432c0773a43696180ac.exe
      "C:\Users\Admin\AppData\Local\Temp\068082355ea6c432c0773a43696180ac.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2288

C:\Users\Admin\AppData\Local\0fedfd17-cc4c-4a69-8e1b-d0e4684ae72f\068082355ea6c432c0773a43696180ac.exe
C:\Users\Admin\AppData\Local\0fedfd17-cc4c-4a69-8e1b-d0e4684ae72f\068082355ea6c432c0773a43696180ac.exe --Task
1⤵
- Executes dropped EXE
PID:2316

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/672-114-0x0000000002210000-0x000000000232B000-memory.dmp

Download

memory/2288-124-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3136-115-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3136-117-0x0000000000400000-0x0000000000537000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads