0a7ec324aeaef589927ae91bdd48990e2bdb48e55c13c24dda46049723fdfccd

General
Target

0a7ec324aeaef589927ae91bdd48990e2bdb48e55c13c24dda46049723fdfccd.exe

Filesize

404KB

Completed

25-11-2021 16:30

Score
8/10
MD5

04cab1dbcee2d16284c7b5537d333f35

SHA1

4294136a11788c415785181c956b15865a758ffe

SHA256

0a7ec324aeaef589927ae91bdd48990e2bdb48e55c13c24dda46049723fdfccd

Malware Config
Signatures 5

Filter: none

Discovery
  • Executes dropped EXE
    SmartClock.exe

    Reported IOCs

    pidprocess
    2628SmartClock.exe
  • Drops startup file
    0a7ec324aeaef589927ae91bdd48990e2bdb48e55c13c24dda46049723fdfccd.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk0a7ec324aeaef589927ae91bdd48990e2bdb48e55c13c24dda46049723fdfccd.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Suspicious behavior: AddClipboardFormatListener
    SmartClock.exe

    Reported IOCs

    pidprocess
    2628SmartClock.exe
  • Suspicious use of WriteProcessMemory
    0a7ec324aeaef589927ae91bdd48990e2bdb48e55c13c24dda46049723fdfccd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2648 wrote to memory of 262826480a7ec324aeaef589927ae91bdd48990e2bdb48e55c13c24dda46049723fdfccd.exeSmartClock.exe
    PID 2648 wrote to memory of 262826480a7ec324aeaef589927ae91bdd48990e2bdb48e55c13c24dda46049723fdfccd.exeSmartClock.exe
    PID 2648 wrote to memory of 262826480a7ec324aeaef589927ae91bdd48990e2bdb48e55c13c24dda46049723fdfccd.exeSmartClock.exe
Processes 2
  • C:\Users\Admin\AppData\Local\Temp\0a7ec324aeaef589927ae91bdd48990e2bdb48e55c13c24dda46049723fdfccd.exe
    "C:\Users\Admin\AppData\Local\Temp\0a7ec324aeaef589927ae91bdd48990e2bdb48e55c13c24dda46049723fdfccd.exe"
    Drops startup file
    Suspicious use of WriteProcessMemory
    PID:2648
    • C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
      "C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
      Executes dropped EXE
      Suspicious behavior: AddClipboardFormatListener
      PID:2628
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe

                          MD5

                          04cab1dbcee2d16284c7b5537d333f35

                          SHA1

                          4294136a11788c415785181c956b15865a758ffe

                          SHA256

                          0a7ec324aeaef589927ae91bdd48990e2bdb48e55c13c24dda46049723fdfccd

                          SHA512

                          bedbaf561859ede57591a1b8e443833e15f93c48fbe60bafce217189c0d200e682bd1280bb982ab3c8e8fd2891e9ff36487c05aa120c4a6bc632e2899c5bebea

                        • C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe

                          MD5

                          04cab1dbcee2d16284c7b5537d333f35

                          SHA1

                          4294136a11788c415785181c956b15865a758ffe

                          SHA256

                          0a7ec324aeaef589927ae91bdd48990e2bdb48e55c13c24dda46049723fdfccd

                          SHA512

                          bedbaf561859ede57591a1b8e443833e15f93c48fbe60bafce217189c0d200e682bd1280bb982ab3c8e8fd2891e9ff36487c05aa120c4a6bc632e2899c5bebea

                        • memory/2628-121-0x0000000001E49000-0x0000000001E75000-memory.dmp

                        • memory/2628-122-0x0000000001C70000-0x0000000001DBA000-memory.dmp

                        • memory/2628-117-0x0000000000000000-mapping.dmp

                        • memory/2628-123-0x0000000000400000-0x0000000001C1B000-memory.dmp

                        • memory/2648-120-0x0000000000400000-0x0000000001C1B000-memory.dmp

                        • memory/2648-115-0x0000000001E59000-0x0000000001E85000-memory.dmp

                        • memory/2648-116-0x0000000001C80000-0x0000000001DCA000-memory.dmp