6da342cf712dc4c102bf41d23bfdae763b189091cc9ef98033917e92dd1c54c9

General

Target

6da342cf712dc4c102bf41d23bfdae763b189091cc9ef98033917e92dd1c54c9.exe
Size

152KB
MD5

26118fb26bd9ed25daf7936ecc3e85e7
SHA1

94dbd51c1f1a024ea2df91d636e2bbebdd88c8d7
SHA256

6da342cf712dc4c102bf41d23bfdae763b189091cc9ef98033917e92dd1c54c9
SHA512

602770e870a728539d59fa1c5a49c6a90f514d9139141840a10d6fb0dcb27969200cadd2cfe52b5f7c6d52540aa9cf4c6e25d235309245d63abe66d321d82b8a

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	6da342cf712dc4c102bf41d23bfdae763b189091cc9ef98033917e92dd1c54c9.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6da342cf712dc4c102bf41d23bfdae763b189091cc9ef98033917e92dd1c54c9.exe"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5024	6da342cf712dc4c102bf41d23bfdae763b189091cc9ef98033917e92dd1c54c9.exe
5024	6da342cf712dc4c102bf41d23bfdae763b189091cc9ef98033917e92dd1c54c9.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5024	6da342cf712dc4c102bf41d23bfdae763b189091cc9ef98033917e92dd1c54c9.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 1784	5024	6da342cf712dc4c102bf41d23bfdae763b189091cc9ef98033917e92dd1c54c9.exe	83
PID 5024 wrote to memory of 1784	5024	6da342cf712dc4c102bf41d23bfdae763b189091cc9ef98033917e92dd1c54c9.exe	83
PID 5024 wrote to memory of 2280	5024	6da342cf712dc4c102bf41d23bfdae763b189091cc9ef98033917e92dd1c54c9.exe	72
PID 1784 wrote to memory of 2148	1784	cmd.exe	85
PID 1784 wrote to memory of 2148	1784	cmd.exe	85
PID 5024 wrote to memory of 2312	5024	6da342cf712dc4c102bf41d23bfdae763b189091cc9ef98033917e92dd1c54c9.exe	71
PID 5024 wrote to memory of 2432	5024	6da342cf712dc4c102bf41d23bfdae763b189091cc9ef98033917e92dd1c54c9.exe	70
PID 5024 wrote to memory of 744	5024	6da342cf712dc4c102bf41d23bfdae763b189091cc9ef98033917e92dd1c54c9.exe	60
PID 5024 wrote to memory of 3252	5024	6da342cf712dc4c102bf41d23bfdae763b189091cc9ef98033917e92dd1c54c9.exe	59

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:744

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2312

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2280

C:\Users\Admin\AppData\Local\Temp\6da342cf712dc4c102bf41d23bfdae763b189091cc9ef98033917e92dd1c54c9.exe
"C:\Users\Admin\AppData\Local\Temp\6da342cf712dc4c102bf41d23bfdae763b189091cc9ef98033917e92dd1c54c9.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\6da342cf712dc4c102bf41d23bfdae763b189091cc9ef98033917e92dd1c54c9.exe" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\6da342cf712dc4c102bf41d23bfdae763b189091cc9ef98033917e92dd1c54c9.exe" /f
    3⤵
    - Adds Run key to start application
    PID:2148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2280-130-0x00007FF7F6810000-0x00007FF7F6B98000-memory.dmp

Filesize
3.5MB

Download
memory/2312-131-0x00007FF7F6810000-0x00007FF7F6B98000-memory.dmp

Filesize
3.5MB

Download

Analysis

Sharing