ae1f419bb8e91810ef9a98c3b5dfdf876b25a9ece8799df4fa75c23fcd3475c3

General

Target

ae1f419bb8e91810ef9a98c3b5dfdf876b25a9ece8799df4fa75c23fcd3475c3.sample.exe
Size

57KB
MD5

1cccdbec21fd05b4500cc78319dffe74
SHA1

af272e1d49b05937a1bd393f8e1b484415af0ab6
SHA256

ae1f419bb8e91810ef9a98c3b5dfdf876b25a9ece8799df4fa75c23fcd3475c3
SHA512

f404c83a44bf47f028eb7a4abf8e0cd79fad3d4e8f5b353353e0bbc2027f7923eb425d66c51e67d78cf27dbac2a77f44abfa640abece95080bd30b50fbfb7bef

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

chrome.exe

pid process

1944 chrome.exe

pid	process
1944	chrome.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\Google\Chrome\chrome.exe	upx
C:\Users\Admin\AppData\Roaming\Google\Chrome\chrome.exe	upx

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1912 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

ae1f419bb8e91810ef9a98c3b5dfdf876b25a9ece8799df4fa75c23fcd3475c3.sample.exe

pid process

784 ae1f419bb8e91810ef9a98c3b5dfdf876b25a9ece8799df4fa75c23fcd3475c3.sample.exe

pid	process
1912	cmd.exe

pid	process
784	ae1f419bb8e91810ef9a98c3b5dfdf876b25a9ece8799df4fa75c23fcd3475c3.sample.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ae1f419bb8e91810ef9a98c3b5dfdf876b25a9ece8799df4fa75c23fcd3475c3.sample.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run	ae1f419bb8e91810ef9a98c3b5dfdf876b25a9ece8799df4fa75c23fcd3475c3.sample.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\Google\\Chrome\\chrome.exe"	ae1f419bb8e91810ef9a98c3b5dfdf876b25a9ece8799df4fa75c23fcd3475c3.sample.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

ae1f419bb8e91810ef9a98c3b5dfdf876b25a9ece8799df4fa75c23fcd3475c3.sample.exe

description	pid	process	target process
PID 784 wrote to memory of 1912	784	ae1f419bb8e91810ef9a98c3b5dfdf876b25a9ece8799df4fa75c23fcd3475c3.sample.exe	cmd.exe
PID 784 wrote to memory of 1912	784	ae1f419bb8e91810ef9a98c3b5dfdf876b25a9ece8799df4fa75c23fcd3475c3.sample.exe	cmd.exe
PID 784 wrote to memory of 1912	784	ae1f419bb8e91810ef9a98c3b5dfdf876b25a9ece8799df4fa75c23fcd3475c3.sample.exe	cmd.exe
PID 784 wrote to memory of 1912	784	ae1f419bb8e91810ef9a98c3b5dfdf876b25a9ece8799df4fa75c23fcd3475c3.sample.exe	cmd.exe
PID 784 wrote to memory of 1944	784	ae1f419bb8e91810ef9a98c3b5dfdf876b25a9ece8799df4fa75c23fcd3475c3.sample.exe	chrome.exe
PID 784 wrote to memory of 1944	784	ae1f419bb8e91810ef9a98c3b5dfdf876b25a9ece8799df4fa75c23fcd3475c3.sample.exe	chrome.exe
PID 784 wrote to memory of 1944	784	ae1f419bb8e91810ef9a98c3b5dfdf876b25a9ece8799df4fa75c23fcd3475c3.sample.exe	chrome.exe
PID 784 wrote to memory of 1944	784	ae1f419bb8e91810ef9a98c3b5dfdf876b25a9ece8799df4fa75c23fcd3475c3.sample.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\ae1f419bb8e91810ef9a98c3b5dfdf876b25a9ece8799df4fa75c23fcd3475c3.sample.exe
"C:\Users\Admin\AppData\Local\Temp\ae1f419bb8e91810ef9a98c3b5dfdf876b25a9ece8799df4fa75c23fcd3475c3.sample.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:784

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\e01cdbef.bat" "
2⤵
- Deletes itself
PID:1912

C:\Users\Admin\AppData\Roaming\Google\Chrome\chrome.exe
"C:\Users\Admin\AppData\Roaming\Google\Chrome\chrome.exe"
2⤵
- Executes dropped EXE
PID:1944

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e01cdbef.bat
MD5
257c159b0fb81197fe0c9c97326a13fb

SHA1
787d0cb1fa19d6bad5d7d2ec01d590ddc4215f13

SHA256
9d8f8a6f01b9eb24062be7635f06867b1510e84ae4544fff333e530dabf41f3b

SHA512
90bf658152988f76e4b29346a4a79f85b3013df4962baa2ecaf595bf418a2267d08523aec61d981df9669e6b5c82b06ada9b568b3efcd8ee0d6f549c93ac9b86

Download Submit
C:\Users\Admin\AppData\Roaming\Google\Chrome\chrome.exe
MD5
1cccdbec21fd05b4500cc78319dffe74

SHA1
af272e1d49b05937a1bd393f8e1b484415af0ab6

SHA256
ae1f419bb8e91810ef9a98c3b5dfdf876b25a9ece8799df4fa75c23fcd3475c3

SHA512
f404c83a44bf47f028eb7a4abf8e0cd79fad3d4e8f5b353353e0bbc2027f7923eb425d66c51e67d78cf27dbac2a77f44abfa640abece95080bd30b50fbfb7bef

Download Submit
\Users\Admin\AppData\Roaming\Google\Chrome\chrome.exe
MD5
1cccdbec21fd05b4500cc78319dffe74

SHA1
af272e1d49b05937a1bd393f8e1b484415af0ab6

SHA256
ae1f419bb8e91810ef9a98c3b5dfdf876b25a9ece8799df4fa75c23fcd3475c3

SHA512
f404c83a44bf47f028eb7a4abf8e0cd79fad3d4e8f5b353353e0bbc2027f7923eb425d66c51e67d78cf27dbac2a77f44abfa640abece95080bd30b50fbfb7bef

Download Submit
memory/784-60-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download
memory/784-61-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/1912-62-0x0000000000000000-mapping.dmp

Download
memory/1944-65-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads