0c51ca0477a2a23eede0757f49f07891c15fe977bde5f293d05ddbce43c9531e

General

Target

0c51ca0477a2a23eede0757f49f07891c15fe977bde5f293d05ddbce43c9531e.exe
Size

386KB
MD5

7bd387176c3b768d4c4c5522072f3753
SHA1

0ec05c75a232a16babe9e7d77d1f9165afb1aac4
SHA256

0c51ca0477a2a23eede0757f49f07891c15fe977bde5f293d05ddbce43c9531e
SHA512

dd9584273adbbbf9f6c8d951bb00b2930a89dd3db2cacdf8f24c7ce57b31e62469da62219c8fc0d3b366add12b3ca32b82a3e74e1463293b1159fd188da46024

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
2436	lJBNe.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	0c51ca0477a2a23eede0757f49f07891c15fe977bde5f293d05ddbce43c9531e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	lJBNe.exe

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\users\\Public\\lJBNe.exe"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2436	lJBNe.exe
2436	lJBNe.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2436	lJBNe.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2436	1648	0c51ca0477a2a23eede0757f49f07891c15fe977bde5f293d05ddbce43c9531e.exe	82
PID 1648 wrote to memory of 2436	1648	0c51ca0477a2a23eede0757f49f07891c15fe977bde5f293d05ddbce43c9531e.exe	82
PID 2436 wrote to memory of 2584	2436	lJBNe.exe	87
PID 2436 wrote to memory of 2584	2436	lJBNe.exe	87
PID 2436 wrote to memory of 2360	2436	lJBNe.exe	55
PID 2584 wrote to memory of 4824	2584	cmd.exe	89
PID 2584 wrote to memory of 4824	2584	cmd.exe	89
PID 2436 wrote to memory of 2408	2436	lJBNe.exe	53
PID 2436 wrote to memory of 2688	2436	lJBNe.exe	20

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2408