c910894a32e7c717310aba2c0e0a021a7c53d035d6244284c249016c6b29b514

General

Target

SECURE_D.exe
Size

1.1MB
MD5

c5c552951da0e502f8aaf0881e2d26bc
SHA1

e279549491a1a76105b0a1d5b258e66de16bd956
SHA256

bda7803bc6a630ed5997870eb0b102e590d6f584b11699fb76781564debe9921
SHA512

e8d414bf468adfdf8c704e667bc8425ddbb02bc69fbe8cf48bd163c515bbdcab58507d834c836604ab385fb8d41b6a2b1a7f497b04c0ac905538fa53076a4c9c

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

232 NOTEPAD.EXE
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

3292 powershell.exe
3292 powershell.exe
3292 powershell.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

OpenWith.exe

pid process

760 OpenWith.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 3292 powershell.exe
Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

OpenWith.exe

pid process

760 OpenWith.exe
760 OpenWith.exe
760 OpenWith.exe
760 OpenWith.exe
760 OpenWith.exe
760 OpenWith.exe
760 OpenWith.exe
760 OpenWith.exe
760 OpenWith.exe

pid	process
232	NOTEPAD.EXE

pid	process
3292	powershell.exe
3292	powershell.exe
3292	powershell.exe

pid	process
760	OpenWith.exe

description	pid	process
Token: SeDebugPrivilege	3292	powershell.exe

pid	process
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

powershell.execmd.exeOpenWith.exe

description	pid	process	target process
PID 3292 wrote to memory of 2252	3292	powershell.exe	cmd.exe
PID 3292 wrote to memory of 2252	3292	powershell.exe	cmd.exe
PID 2252 wrote to memory of 952	2252	cmd.exe	SECURE_D.exe
PID 2252 wrote to memory of 952	2252	cmd.exe	SECURE_D.exe
PID 2252 wrote to memory of 952	2252	cmd.exe	SECURE_D.exe
PID 760 wrote to memory of 232	760	OpenWith.exe	NOTEPAD.EXE
PID 760 wrote to memory of 232	760	OpenWith.exe	NOTEPAD.EXE

C:\Users\Admin\AppData\Local\Temp\SECURE_D.exe
"C:\Users\Admin\AppData\Local\Temp\SECURE_D.exe"
1⤵
PID:3960

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3292

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2252

C:\Users\Admin\AppData\Local\Temp\SECURE_D.exe
secure_d
3⤵
PID:952

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\187559910\payload.dat
2⤵
- Opens file in notepad (likely ransom note)
PID:232

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SECURE_D.exe.log
MD5
90acfd72f14a512712b1a7380c0faf60

SHA1
40ba4accb8faa75887e84fb8e38d598dc8cf0f12

SHA256
20806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86

SHA512
29dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9

Download Submit
memory/952-185-0x0000000004F50000-0x0000000004FEC000-memory.dmp

Filesize
624KB

Download
memory/952-184-0x0000000004F50000-0x0000000004FEC000-memory.dmp

Filesize
624KB

Download
memory/952-183-0x0000000073FC0000-0x00000000746AE000-memory.dmp

Filesize
6.9MB

Download
memory/3292-164-0x000001F1DCF70000-0x000001F1DCFE6000-memory.dmp

Filesize
472KB

Download
memory/3292-153-0x000001F1DCEB0000-0x000001F1DCEEC000-memory.dmp

Filesize
240KB

Download
memory/3292-147-0x000001F1DA863000-0x000001F1DA865000-memory.dmp

Filesize
8KB

Download
memory/3292-144-0x000001F1DA860000-0x000001F1DA862000-memory.dmp

Filesize
8KB

Download
memory/3292-143-0x00007FFFAE300000-0x00007FFFAECEC000-memory.dmp

Filesize
9.9MB

Download
memory/3292-129-0x000001F1DC8E0000-0x000001F1DC902000-memory.dmp

Filesize
136KB

Download
memory/3960-123-0x0000000004D90000-0x000000000528E000-memory.dmp

Filesize
5.0MB

Download
memory/3960-122-0x0000000008360000-0x0000000008410000-memory.dmp

Filesize
704KB

Download
memory/3960-121-0x0000000004D90000-0x000000000528E000-memory.dmp

Filesize
5.0MB

Download
memory/3960-120-0x0000000004F50000-0x0000000004FA6000-memory.dmp

Filesize
344KB

Download
memory/3960-119-0x0000000004C90000-0x0000000004C9A000-memory.dmp

Filesize
40KB

Download
memory/3960-114-0x0000000000360000-0x000000000047C000-memory.dmp

Filesize
1.1MB

Download
memory/3960-118-0x0000000073F20000-0x000000007460E000-memory.dmp

Filesize
6.9MB

Download
memory/3960-117-0x0000000004D90000-0x0000000004E22000-memory.dmp

Filesize
584KB

Download
memory/3960-116-0x0000000005290000-0x000000000578E000-memory.dmp

Filesize
5.0MB

Download
memory/3960-115-0x0000000004CF0000-0x0000000004D8C000-memory.dmp

Filesize
624KB

Download

Analysis

Sharing