e1c85bc8a605ec9f81f45d5ff343b7283bcee0a4ee954539dd70e3cba1ae51e8

General

Target

e1c85bc8a605ec9f81f45d5ff343b7283bcee0a4ee954539dd70e3cba1ae51e8.exe
Size

152KB
MD5

de6969e4d9745875d1a7052210e87e71
SHA1

6916a4b85b34517b2966c63140c2b782783bbed0
SHA256

e1c85bc8a605ec9f81f45d5ff343b7283bcee0a4ee954539dd70e3cba1ae51e8
SHA512

c9df738232cd55f8ecd867e9216e799254faa29b2ebd27def1b18721b4cc71f63b374fe5336894a7483569ef0139947cb54cfb712f95bced07991f6449197307

Score

7^/10

persistence

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	e1c85bc8a605ec9f81f45d5ff343b7283bcee0a4ee954539dd70e3cba1ae51e8.exe

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e1c85bc8a605ec9f81f45d5ff343b7283bcee0a4ee954539dd70e3cba1ae51e8.exe"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2440	e1c85bc8a605ec9f81f45d5ff343b7283bcee0a4ee954539dd70e3cba1ae51e8.exe
2440	e1c85bc8a605ec9f81f45d5ff343b7283bcee0a4ee954539dd70e3cba1ae51e8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2440	e1c85bc8a605ec9f81f45d5ff343b7283bcee0a4ee954539dd70e3cba1ae51e8.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 5004	2440	e1c85bc8a605ec9f81f45d5ff343b7283bcee0a4ee954539dd70e3cba1ae51e8.exe	82
PID 2440 wrote to memory of 5004	2440	e1c85bc8a605ec9f81f45d5ff343b7283bcee0a4ee954539dd70e3cba1ae51e8.exe	82
PID 2440 wrote to memory of 2356	2440	e1c85bc8a605ec9f81f45d5ff343b7283bcee0a4ee954539dd70e3cba1ae51e8.exe	80
PID 2440 wrote to memory of 2364	2440	e1c85bc8a605ec9f81f45d5ff343b7283bcee0a4ee954539dd70e3cba1ae51e8.exe	79
PID 5004 wrote to memory of 3640	5004	cmd.exe	84
PID 5004 wrote to memory of 3640	5004	cmd.exe	84
PID 2440 wrote to memory of 2556	2440	e1c85bc8a605ec9f81f45d5ff343b7283bcee0a4ee954539dd70e3cba1ae51e8.exe	75
PID 2440 wrote to memory of 2764	2440	e1c85bc8a605ec9f81f45d5ff343b7283bcee0a4ee954539dd70e3cba1ae51e8.exe	69
PID 2440 wrote to memory of 3256	2440	e1c85bc8a605ec9f81f45d5ff343b7283bcee0a4ee954539dd70e3cba1ae51e8.exe	68

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2764

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2364