9e8f01b3fb2513649da36630fd7d20a2b87d11d5ec2e1f151498fd879d0d6d39

General

Target

9e8f01b3fb2513649da36630fd7d20a2b87d11d5ec2e1f151498fd879d0d6d39.exe
Size

170KB
MD5

26f3ee3f591b0d3a267d8b1ac6ffd59c
SHA1

e4f263ef3beb7e77ade5225c9d1e7d24bab668d0
SHA256

9e8f01b3fb2513649da36630fd7d20a2b87d11d5ec2e1f151498fd879d0d6d39
SHA512

aaae22bf758fbf8fe707ad0ee6d9e30421924461be1470d1232d8c20b404310070175f2f59db84f0d31220e5198c2290012fe18c25a005d02bcb6bf3921b10cb

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	9e8f01b3fb2513649da36630fd7d20a2b87d11d5ec2e1f151498fd879d0d6d39.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9e8f01b3fb2513649da36630fd7d20a2b87d11d5ec2e1f151498fd879d0d6d39.exe"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5044	9e8f01b3fb2513649da36630fd7d20a2b87d11d5ec2e1f151498fd879d0d6d39.exe
5044	9e8f01b3fb2513649da36630fd7d20a2b87d11d5ec2e1f151498fd879d0d6d39.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5044	9e8f01b3fb2513649da36630fd7d20a2b87d11d5ec2e1f151498fd879d0d6d39.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 1260	5044	9e8f01b3fb2513649da36630fd7d20a2b87d11d5ec2e1f151498fd879d0d6d39.exe	84
PID 5044 wrote to memory of 1260	5044	9e8f01b3fb2513649da36630fd7d20a2b87d11d5ec2e1f151498fd879d0d6d39.exe	84
PID 5044 wrote to memory of 2268	5044	9e8f01b3fb2513649da36630fd7d20a2b87d11d5ec2e1f151498fd879d0d6d39.exe	61
PID 1260 wrote to memory of 4696	1260	cmd.exe	86
PID 1260 wrote to memory of 4696	1260	cmd.exe	86
PID 5044 wrote to memory of 2288	5044	9e8f01b3fb2513649da36630fd7d20a2b87d11d5ec2e1f151498fd879d0d6d39.exe	26
PID 5044 wrote to memory of 2412	5044	9e8f01b3fb2513649da36630fd7d20a2b87d11d5ec2e1f151498fd879d0d6d39.exe	60
PID 5044 wrote to memory of 2660	5044	9e8f01b3fb2513649da36630fd7d20a2b87d11d5ec2e1f151498fd879d0d6d39.exe	52
PID 5044 wrote to memory of 3204	5044	9e8f01b3fb2513649da36630fd7d20a2b87d11d5ec2e1f151498fd879d0d6d39.exe	30

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2288

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2660

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2412

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2268

C:\Users\Admin\AppData\Local\Temp\9e8f01b3fb2513649da36630fd7d20a2b87d11d5ec2e1f151498fd879d0d6d39.exe
"C:\Users\Admin\AppData\Local\Temp\9e8f01b3fb2513649da36630fd7d20a2b87d11d5ec2e1f151498fd879d0d6d39.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\9e8f01b3fb2513649da36630fd7d20a2b87d11d5ec2e1f151498fd879d0d6d39.exe" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1260
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\9e8f01b3fb2513649da36630fd7d20a2b87d11d5ec2e1f151498fd879d0d6d39.exe" /f
    3⤵
    - Adds Run key to start application
    PID:4696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2268-130-0x00007FF639490000-0x00007FF63981E000-memory.dmp

Filesize
3.6MB

Download
memory/2660-131-0x00007FF639490000-0x00007FF63981E000-memory.dmp

Filesize
3.6MB

Download

Analysis

Sharing