b235d1cb6c892523f097d191c05c627933087a960046712068c54b0b50fb3898

General

Target

b235d1cb6c892523f097d191c05c627933087a960046712068c54b0b50fb3898.exe
Size

70KB
MD5

b3fe815bdb07617fb1df93a6effe1e50
SHA1

df108ca383c8444b5db2120673b2c2570820b0a2
SHA256

b235d1cb6c892523f097d191c05c627933087a960046712068c54b0b50fb3898
SHA512

793fc00bb92b035a977646b62293635441faa76f69ea73680c69c76975490dcc3b7cff551e9b0396760c635371a1b01b913c8523769eadc177f1a8a859c21d92

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 4 IoCs

Processes:

iconsmail.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	iconsmail.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	iconsmail.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	iconsmail.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	iconsmail.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

iconsmail.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	iconsmail.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	iconsmail.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	iconsmail.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

iconsmail.exe

pid	process
2272	iconsmail.exe
2272	iconsmail.exe
2272	iconsmail.exe
2272	iconsmail.exe
2272	iconsmail.exe
2272	iconsmail.exe
2272	iconsmail.exe
2272	iconsmail.exe
2272	iconsmail.exe
2272	iconsmail.exe
2272	iconsmail.exe
2272	iconsmail.exe
2272	iconsmail.exe
2272	iconsmail.exe
2272	iconsmail.exe
2272	iconsmail.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

b235d1cb6c892523f097d191c05c627933087a960046712068c54b0b50fb3898.exe

pid process

2180 b235d1cb6c892523f097d191c05c627933087a960046712068c54b0b50fb3898.exe

pid	process
2180	b235d1cb6c892523f097d191c05c627933087a960046712068c54b0b50fb3898.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

b235d1cb6c892523f097d191c05c627933087a960046712068c54b0b50fb3898.exeiconsmail.exe

description	pid	process	target process
PID 3028 wrote to memory of 2180	3028	b235d1cb6c892523f097d191c05c627933087a960046712068c54b0b50fb3898.exe	b235d1cb6c892523f097d191c05c627933087a960046712068c54b0b50fb3898.exe
PID 3028 wrote to memory of 2180	3028	b235d1cb6c892523f097d191c05c627933087a960046712068c54b0b50fb3898.exe	b235d1cb6c892523f097d191c05c627933087a960046712068c54b0b50fb3898.exe
PID 3028 wrote to memory of 2180	3028	b235d1cb6c892523f097d191c05c627933087a960046712068c54b0b50fb3898.exe	b235d1cb6c892523f097d191c05c627933087a960046712068c54b0b50fb3898.exe
PID 3312 wrote to memory of 2272	3312	iconsmail.exe	iconsmail.exe
PID 3312 wrote to memory of 2272	3312	iconsmail.exe	iconsmail.exe
PID 3312 wrote to memory of 2272	3312	iconsmail.exe	iconsmail.exe

C:\Users\Admin\AppData\Local\Temp\b235d1cb6c892523f097d191c05c627933087a960046712068c54b0b50fb3898.exe
"C:\Users\Admin\AppData\Local\Temp\b235d1cb6c892523f097d191c05c627933087a960046712068c54b0b50fb3898.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Users\Admin\AppData\Local\Temp\b235d1cb6c892523f097d191c05c627933087a960046712068c54b0b50fb3898.exe
  --426c4f32
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2180

C:\Windows\SysWOW64\iconsmail.exe
"C:\Windows\SysWOW64\iconsmail.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\SysWOW64\iconsmail.exe
  --7a6b3be7
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2272

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads