797b65020bbfa1c58f0d72c7d0ee746fcf28acbaeaad7c5877ff9c53a8bf1cf4

General

Target
4c56095dc5818d4ab935ca0af8270be2.exe
Size 842KB
Sample210601-161qevp1r2
SHA256 797b65020bbfa1c58f0d72c7d0ee746fcf28acbaeaad7c5877ff9c53a8bf1cf4
MD5 4c56095dc5818d4ab935ca0af8270be2
SHA1 f0d271daa2d2243b44e51af24d65fdfc65255ddc
SHA512 d9eb8e469114bfa19eb5f5793c49f67517eb43f5731ed781826814f802892b5f7af9c776b573e6d8b0ff6a7783133a61ec5e59abcf855b1acad630eab3db7698
MD5 SHA1 SHA512

Score

7^/10

discovery persistence

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
656	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\200dba46-6e36-4687-910f-5fb1a491f40e\\4c56095dc5818d4ab935ca0af8270be2.exe\" --AutoStart"	4c56095dc5818d4ab935ca0af8270be2.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	api.2ip.ua
9	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 668 set thread context of 2584	668	4c56095dc5818d4ab935ca0af8270be2.exe	77
PID 4024 set thread context of 3548	4024	4c56095dc5818d4ab935ca0af8270be2.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2584	4c56095dc5818d4ab935ca0af8270be2.exe
2584	4c56095dc5818d4ab935ca0af8270be2.exe
3548	4c56095dc5818d4ab935ca0af8270be2.exe
3548	4c56095dc5818d4ab935ca0af8270be2.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 668 wrote to memory of 2584	668	4c56095dc5818d4ab935ca0af8270be2.exe	77
PID 668 wrote to memory of 2584	668	4c56095dc5818d4ab935ca0af8270be2.exe	77
PID 668 wrote to memory of 2584	668	4c56095dc5818d4ab935ca0af8270be2.exe	77
PID 668 wrote to memory of 2584	668	4c56095dc5818d4ab935ca0af8270be2.exe	77
PID 668 wrote to memory of 2584	668	4c56095dc5818d4ab935ca0af8270be2.exe	77
PID 668 wrote to memory of 2584	668	4c56095dc5818d4ab935ca0af8270be2.exe	77
PID 668 wrote to memory of 2584	668	4c56095dc5818d4ab935ca0af8270be2.exe	77
PID 668 wrote to memory of 2584	668	4c56095dc5818d4ab935ca0af8270be2.exe	77
PID 668 wrote to memory of 2584	668	4c56095dc5818d4ab935ca0af8270be2.exe	77
PID 668 wrote to memory of 2584	668	4c56095dc5818d4ab935ca0af8270be2.exe	77
PID 2584 wrote to memory of 656	2584	4c56095dc5818d4ab935ca0af8270be2.exe	79
PID 2584 wrote to memory of 656	2584	4c56095dc5818d4ab935ca0af8270be2.exe	79
PID 2584 wrote to memory of 656	2584	4c56095dc5818d4ab935ca0af8270be2.exe	79
PID 2584 wrote to memory of 4024	2584	4c56095dc5818d4ab935ca0af8270be2.exe	80
PID 2584 wrote to memory of 4024	2584	4c56095dc5818d4ab935ca0af8270be2.exe	80
PID 2584 wrote to memory of 4024	2584	4c56095dc5818d4ab935ca0af8270be2.exe	80
PID 4024 wrote to memory of 3548	4024	4c56095dc5818d4ab935ca0af8270be2.exe	82
PID 4024 wrote to memory of 3548	4024	4c56095dc5818d4ab935ca0af8270be2.exe	82
PID 4024 wrote to memory of 3548	4024	4c56095dc5818d4ab935ca0af8270be2.exe	82
PID 4024 wrote to memory of 3548	4024	4c56095dc5818d4ab935ca0af8270be2.exe	82
PID 4024 wrote to memory of 3548	4024	4c56095dc5818d4ab935ca0af8270be2.exe	82
PID 4024 wrote to memory of 3548	4024	4c56095dc5818d4ab935ca0af8270be2.exe	82
PID 4024 wrote to memory of 3548	4024	4c56095dc5818d4ab935ca0af8270be2.exe	82
PID 4024 wrote to memory of 3548	4024	4c56095dc5818d4ab935ca0af8270be2.exe	82
PID 4024 wrote to memory of 3548	4024	4c56095dc5818d4ab935ca0af8270be2.exe	82
PID 4024 wrote to memory of 3548	4024	4c56095dc5818d4ab935ca0af8270be2.exe	82

C:\Users\Admin\AppData\Local\Temp\4c56095dc5818d4ab935ca0af8270be2.exe
"C:\Users\Admin\AppData\Local\Temp\4c56095dc5818d4ab935ca0af8270be2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:668
- C:\Users\Admin\AppData\Local\Temp\4c56095dc5818d4ab935ca0af8270be2.exe
  "C:\Users\Admin\AppData\Local\Temp\4c56095dc5818d4ab935ca0af8270be2.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\200dba46-6e36-4687-910f-5fb1a491f40e" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:656
- - C:\Users\Admin\AppData\Local\Temp\4c56095dc5818d4ab935ca0af8270be2.exe
    "C:\Users\Admin\AppData\Local\Temp\4c56095dc5818d4ab935ca0af8270be2.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4024
  - - C:\Users\Admin\AppData\Local\Temp\4c56095dc5818d4ab935ca0af8270be2.exe
      "C:\Users\Admin\AppData\Local\Temp\4c56095dc5818d4ab935ca0af8270be2.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3548

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/668-114-0x0000000002430000-0x000000000254B000-memory.dmp

Download

memory/2584-115-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2584-117-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3548-124-0x0000000000400000-0x0000000000537000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads