0d9c922bee2527bad6511502a7bbf9b5f72a07311447d7c010d3d9c2ef3828f4

General

Target

0d9c922bee2527bad6511502a7bbf9b5f72a07311447d7c010d3d9c2ef3828f4.exe
Size

170KB
MD5

2fa75d30fbae89cbfef6bef7640319cc
SHA1

a6e87d2a36c8c22d9501344fe5444622e79d39bf
SHA256

0d9c922bee2527bad6511502a7bbf9b5f72a07311447d7c010d3d9c2ef3828f4
SHA512

65d80136764a14358d421a3aba12e6f9284a084c0fc1ac362b402b7ab613826883a6e44360ebbfbf620fe2f1e30e40950e0044f95b69e88dabbb4c4f3eaae9af

Score

7^/10

persistence

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

0d9c922bee2527bad6511502a7bbf9b5f72a07311447d7c010d3d9c2ef3828f4.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	0d9c922bee2527bad6511502a7bbf9b5f72a07311447d7c010d3d9c2ef3828f4.exe

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0d9c922bee2527bad6511502a7bbf9b5f72a07311447d7c010d3d9c2ef3828f4.exe"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

0d9c922bee2527bad6511502a7bbf9b5f72a07311447d7c010d3d9c2ef3828f4.exe

pid	process
1332	0d9c922bee2527bad6511502a7bbf9b5f72a07311447d7c010d3d9c2ef3828f4.exe
1332	0d9c922bee2527bad6511502a7bbf9b5f72a07311447d7c010d3d9c2ef3828f4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0d9c922bee2527bad6511502a7bbf9b5f72a07311447d7c010d3d9c2ef3828f4.exe

description pid process

Token: SeDebugPrivilege 1332 0d9c922bee2527bad6511502a7bbf9b5f72a07311447d7c010d3d9c2ef3828f4.exe

description	pid	process
Token: SeDebugPrivilege	1332	0d9c922bee2527bad6511502a7bbf9b5f72a07311447d7c010d3d9c2ef3828f4.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

0d9c922bee2527bad6511502a7bbf9b5f72a07311447d7c010d3d9c2ef3828f4.execmd.exe

description	pid	process	target process
PID 1332 wrote to memory of 1284	1332	0d9c922bee2527bad6511502a7bbf9b5f72a07311447d7c010d3d9c2ef3828f4.exe	cmd.exe
PID 1332 wrote to memory of 1284	1332	0d9c922bee2527bad6511502a7bbf9b5f72a07311447d7c010d3d9c2ef3828f4.exe	cmd.exe
PID 1332 wrote to memory of 2344	1332	0d9c922bee2527bad6511502a7bbf9b5f72a07311447d7c010d3d9c2ef3828f4.exe	sihost.exe
PID 1284 wrote to memory of 1736	1284	cmd.exe	reg.exe
PID 1284 wrote to memory of 1736	1284	cmd.exe	reg.exe
PID 1332 wrote to memory of 2380	1332	0d9c922bee2527bad6511502a7bbf9b5f72a07311447d7c010d3d9c2ef3828f4.exe	svchost.exe
PID 1332 wrote to memory of 2440	1332	0d9c922bee2527bad6511502a7bbf9b5f72a07311447d7c010d3d9c2ef3828f4.exe	taskhostw.exe
PID 1332 wrote to memory of 2992	1332	0d9c922bee2527bad6511502a7bbf9b5f72a07311447d7c010d3d9c2ef3828f4.exe	svchost.exe
PID 1332 wrote to memory of 3284	1332	0d9c922bee2527bad6511502a7bbf9b5f72a07311447d7c010d3d9c2ef3828f4.exe	DllHost.exe

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2992

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2380

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\0d9c922bee2527bad6511502a7bbf9b5f72a07311447d7c010d3d9c2ef3828f4.exe" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:1284

C:\Windows\system32\reg.exe
REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\0d9c922bee2527bad6511502a7bbf9b5f72a07311447d7c010d3d9c2ef3828f4.exe" /f
3⤵
- Adds Run key to start application
PID:1736