9634e7bbda11d42ed7eda4f7cc1965dea16ab45877cb425d322e830cf63a0657

General

Target
b66204eff102db67bd94ec3096c765c3.exe
Size 837KB
Sample210707-avefn7wpr6
SHA256 9634e7bbda11d42ed7eda4f7cc1965dea16ab45877cb425d322e830cf63a0657
MD5 b66204eff102db67bd94ec3096c765c3
SHA1 10e29764f0182cb7362460f6d925a88b9d772780
SHA512 68527e99df477f3ef63f26457c0d6b52736b0daaa5551c19d83022115497978e0e9b336f77b6d50f049bfa278afdb3246349cb9e996b80104820843ad2f53687
MD5 SHA1 SHA512

Score

7^/10

discovery persistence

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1964	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\5ff801cd-61f3-4ca0-8bf2-e217c973a496\\b66204eff102db67bd94ec3096c765c3.exe\" --AutoStart"	b66204eff102db67bd94ec3096c765c3.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
11	api.2ip.ua
21	api.2ip.ua
10	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 652 set thread context of 2956	652	b66204eff102db67bd94ec3096c765c3.exe	77
PID 2812 set thread context of 2064	2812	b66204eff102db67bd94ec3096c765c3.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	b66204eff102db67bd94ec3096c765c3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	b66204eff102db67bd94ec3096c765c3.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2956	b66204eff102db67bd94ec3096c765c3.exe
2956	b66204eff102db67bd94ec3096c765c3.exe
2064	b66204eff102db67bd94ec3096c765c3.exe
2064	b66204eff102db67bd94ec3096c765c3.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 2956	652	b66204eff102db67bd94ec3096c765c3.exe	77
PID 652 wrote to memory of 2956	652	b66204eff102db67bd94ec3096c765c3.exe	77
PID 652 wrote to memory of 2956	652	b66204eff102db67bd94ec3096c765c3.exe	77
PID 652 wrote to memory of 2956	652	b66204eff102db67bd94ec3096c765c3.exe	77
PID 652 wrote to memory of 2956	652	b66204eff102db67bd94ec3096c765c3.exe	77
PID 652 wrote to memory of 2956	652	b66204eff102db67bd94ec3096c765c3.exe	77
PID 652 wrote to memory of 2956	652	b66204eff102db67bd94ec3096c765c3.exe	77
PID 652 wrote to memory of 2956	652	b66204eff102db67bd94ec3096c765c3.exe	77
PID 652 wrote to memory of 2956	652	b66204eff102db67bd94ec3096c765c3.exe	77
PID 652 wrote to memory of 2956	652	b66204eff102db67bd94ec3096c765c3.exe	77
PID 2956 wrote to memory of 1964	2956	b66204eff102db67bd94ec3096c765c3.exe	78
PID 2956 wrote to memory of 1964	2956	b66204eff102db67bd94ec3096c765c3.exe	78
PID 2956 wrote to memory of 1964	2956	b66204eff102db67bd94ec3096c765c3.exe	78
PID 2956 wrote to memory of 2812	2956	b66204eff102db67bd94ec3096c765c3.exe	79
PID 2956 wrote to memory of 2812	2956	b66204eff102db67bd94ec3096c765c3.exe	79
PID 2956 wrote to memory of 2812	2956	b66204eff102db67bd94ec3096c765c3.exe	79
PID 2812 wrote to memory of 2064	2812	b66204eff102db67bd94ec3096c765c3.exe	82
PID 2812 wrote to memory of 2064	2812	b66204eff102db67bd94ec3096c765c3.exe	82
PID 2812 wrote to memory of 2064	2812	b66204eff102db67bd94ec3096c765c3.exe	82
PID 2812 wrote to memory of 2064	2812	b66204eff102db67bd94ec3096c765c3.exe	82
PID 2812 wrote to memory of 2064	2812	b66204eff102db67bd94ec3096c765c3.exe	82
PID 2812 wrote to memory of 2064	2812	b66204eff102db67bd94ec3096c765c3.exe	82
PID 2812 wrote to memory of 2064	2812	b66204eff102db67bd94ec3096c765c3.exe	82
PID 2812 wrote to memory of 2064	2812	b66204eff102db67bd94ec3096c765c3.exe	82
PID 2812 wrote to memory of 2064	2812	b66204eff102db67bd94ec3096c765c3.exe	82
PID 2812 wrote to memory of 2064	2812	b66204eff102db67bd94ec3096c765c3.exe	82

C:\Users\Admin\AppData\Local\Temp\b66204eff102db67bd94ec3096c765c3.exe
"C:\Users\Admin\AppData\Local\Temp\b66204eff102db67bd94ec3096c765c3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:652
- C:\Users\Admin\AppData\Local\Temp\b66204eff102db67bd94ec3096c765c3.exe
  "C:\Users\Admin\AppData\Local\Temp\b66204eff102db67bd94ec3096c765c3.exe"
  2⤵
  - Adds Run key to start application
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\5ff801cd-61f3-4ca0-8bf2-e217c973a496" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:1964
- - C:\Users\Admin\AppData\Local\Temp\b66204eff102db67bd94ec3096c765c3.exe
    "C:\Users\Admin\AppData\Local\Temp\b66204eff102db67bd94ec3096c765c3.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\b66204eff102db67bd94ec3096c765c3.exe
      "C:\Users\Admin\AppData\Local\Temp\b66204eff102db67bd94ec3096c765c3.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2064