06cf7c7c1a2d8f8647c977803466fd5b3a39dded0312fb23575eeacfaeaf07d6

General

Target
b9d0d135d4feddc5dbda11c5aa4cc586.exe
Size 1.6MB
Sample210624-e6t6fl1dnx
SHA256 06cf7c7c1a2d8f8647c977803466fd5b3a39dded0312fb23575eeacfaeaf07d6
MD5 b9d0d135d4feddc5dbda11c5aa4cc586
SHA1 02da0f0321e163cbabcbf3935204352b6a7de36d
SHA512 f776271b724fed807e54435878a921ed820217ff796d04c1f84afdd6e756b987275c40b0c12c07ba6fea397909b9048ed03e06a4b6dda53155b6a59229357f37
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
472	Dir.exe.com
1628	Dir.exe.com

Loads dropped DLL 2 IoCs

pid	Process
2028	cmd.exe
472	Dir.exe.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Dir.exe.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Dir.exe.com

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1152	PING.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 828	1836	b9d0d135d4feddc5dbda11c5aa4cc586.exe	26
PID 1836 wrote to memory of 828	1836	b9d0d135d4feddc5dbda11c5aa4cc586.exe	26
PID 1836 wrote to memory of 828	1836	b9d0d135d4feddc5dbda11c5aa4cc586.exe	26
PID 1836 wrote to memory of 828	1836	b9d0d135d4feddc5dbda11c5aa4cc586.exe	26
PID 828 wrote to memory of 2028	828	cmd.exe	28
PID 828 wrote to memory of 2028	828	cmd.exe	28
PID 828 wrote to memory of 2028	828	cmd.exe	28
PID 828 wrote to memory of 2028	828	cmd.exe	28
PID 2028 wrote to memory of 1944	2028	cmd.exe	29
PID 2028 wrote to memory of 1944	2028	cmd.exe	29
PID 2028 wrote to memory of 1944	2028	cmd.exe	29
PID 2028 wrote to memory of 1944	2028	cmd.exe	29
PID 2028 wrote to memory of 472	2028	cmd.exe	30
PID 2028 wrote to memory of 472	2028	cmd.exe	30
PID 2028 wrote to memory of 472	2028	cmd.exe	30
PID 2028 wrote to memory of 472	2028	cmd.exe	30
PID 2028 wrote to memory of 1152	2028	cmd.exe	31
PID 2028 wrote to memory of 1152	2028	cmd.exe	31
PID 2028 wrote to memory of 1152	2028	cmd.exe	31
PID 2028 wrote to memory of 1152	2028	cmd.exe	31
PID 472 wrote to memory of 1628	472	Dir.exe.com	32
PID 472 wrote to memory of 1628	472	Dir.exe.com	32
PID 472 wrote to memory of 1628	472	Dir.exe.com	32
PID 472 wrote to memory of 1628	472	Dir.exe.com	32

C:\Users\Admin\AppData\Local\Temp\b9d0d135d4feddc5dbda11c5aa4cc586.exe
"C:\Users\Admin\AppData\Local\Temp\b9d0d135d4feddc5dbda11c5aa4cc586.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cmd < Mostra.jar
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2028
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^MvfbkfITdzmqvzpcDFGyNcZWzrEfTQhrBeBvmkWJSEqlaWEzJGeiLmJdvatoLzZAucnxSMVaJXjocOEvmlFjOyaealZiuNYmEAtXnpBWLKnOjBV$" Hai.jar
      4⤵
      PID:1944
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com
      Dir.exe.com v
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:472
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com v
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:1628
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 30
      4⤵
      Runs ping.exe
      PID:1152

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1628-78-0x00000000001D0000-0x00000000001D1000-memory.dmp

Download

memory/1836-59-0x0000000074D91000-0x0000000074D93000-memory.dmp