73c64cc8fcfb9a95a1a7a4caf2f42c48727ab4a557d34d1fde2801761878a794

General

Target
2ed9e4b847d4798713e5c6f5e1efc6f7.exe
Size 263KB
Sample220412-ppgegaeee6
SHA256 73c64cc8fcfb9a95a1a7a4caf2f42c48727ab4a557d34d1fde2801761878a794
MD5 2ed9e4b847d4798713e5c6f5e1efc6f7
SHA1 da5c8742498cad5fd118b0c3f48a76cbb1e6f784
SHA512 fc80b08112c5da4f6c5394104f8e5f07a8aa9170e5598207496d5f11958be4403b010a4da1fdbba101d5315ad8aafe7b9a096a6226efd97d42f4ad5c407ad8cd
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2036	fxxtb.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvhgulber = "C:\\Users\\Admin\\AppData\\Roaming\\owxsjyjtsr\\nvdaoffmf.exe"	fxxtb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 2036	3192	2ed9e4b847d4798713e5c6f5e1efc6f7.exe	83
PID 3192 wrote to memory of 2036	3192	2ed9e4b847d4798713e5c6f5e1efc6f7.exe	83
PID 3192 wrote to memory of 2036	3192	2ed9e4b847d4798713e5c6f5e1efc6f7.exe	83
PID 2036 wrote to memory of 2380	2036	fxxtb.exe	84
PID 2036 wrote to memory of 2380	2036	fxxtb.exe	84
PID 2036 wrote to memory of 2380	2036	fxxtb.exe	84

C:\Users\Admin\AppData\Local\Temp\2ed9e4b847d4798713e5c6f5e1efc6f7.exe
"C:\Users\Admin\AppData\Local\Temp\2ed9e4b847d4798713e5c6f5e1efc6f7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Users\Admin\AppData\Local\Temp\fxxtb.exe
  C:\Users\Admin\AppData\Local\Temp\fxxtb.exe C:\Users\Admin\AppData\Local\Temp\lzbbh
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Users\Admin\AppData\Local\Temp\fxxtb.exe
    C:\Users\Admin\AppData\Local\Temp\fxxtb.exe C:\Users\Admin\AppData\Local\Temp\lzbbh
    3⤵
    PID:2380

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

csgp9ylpcg6yo

Path C:\Users\Admin\AppData\Local\Temp\csgp9ylpcg6yo
Size 285KB
SHA256 88b05a4e26e25861325d5a6b65469925e81ccbd25da6c193bf7dc84a672039fb
MD5 c5e9d1289c6d35726416466d4466d3a1
SHA1 45f5d01c2a9cb98c6a780420fb3bfcad59b6104c
SHA512 62ad86a8a79b73142b76bb2b1ea992063ad38aec8759dd9db8d68015d13fbf18f19f2876f8ff1f795494dddb5e7c6b57d34644f99c2c2e58748baa6165d038e7
SSDEEP 6144:sEuTsy9KBywDsj8Sgy7cpjop3LCqpMEdgkyTwex48qSvLxbN+:RuTsAKQWog1Bop3eqpMdkSpxZxDxN+
MD5 SHA1 SHA512 SSDEEP

Submit Download

fxxtb.exe

Path C:\Users\Admin\AppData\Local\Temp\fxxtb.exe
Size 5KB
SHA256 a3cfb0415561e8aa63319a3adccee6c9b6af36e9519dabcbd82cc0138ddd957d
MD5 7b4e27a64359dd034e68862bc9ce0baf
SHA1 fc6a7b362fe47be1f351dba9cb52175e2aa06ad0
SHA512 573a4425c2d691807fd9442bbefc177486f1e63cfe9ade04e282bd03d34da7d9a00c4cfcdb1d4ea2c1cd0d8276b48278f02bf71a1463d58480ea4a6594104e7a
SSDEEP 96:5LlLAss5FBBQbcIXqUwC+IXq5k69/qiDxQ:5LERiDXNX09xK
MD5 SHA1 SHA512 SSDEEP

Submit Download

fxxtb.exe

Path C:\Users\Admin\AppData\Local\Temp\fxxtb.exe
Size 5KB
SHA256 a3cfb0415561e8aa63319a3adccee6c9b6af36e9519dabcbd82cc0138ddd957d
MD5 7b4e27a64359dd034e68862bc9ce0baf
SHA1 fc6a7b362fe47be1f351dba9cb52175e2aa06ad0
SHA512 573a4425c2d691807fd9442bbefc177486f1e63cfe9ade04e282bd03d34da7d9a00c4cfcdb1d4ea2c1cd0d8276b48278f02bf71a1463d58480ea4a6594104e7a
SSDEEP 96:5LlLAss5FBBQbcIXqUwC+IXq5k69/qiDxQ:5LERiDXNX09xK
MD5 SHA1 SHA512 SSDEEP

Submit Download

lzbbh

Path C:\Users\Admin\AppData\Local\Temp\lzbbh
Size 7KB
SHA256 02f001055cfc8fff7c0be7578e958f73e5da50abd9fcef5d91ad4a5c25363314
MD5 a0219b78e3acd7f1d0acef0db4e1502f
SHA1 931a0407079f12b89e0321633769536acdffc769
SHA512 f0d3e5fb188e0f16fedcecde19ce1b9542447ff831f3624cc9876843126fbcbf6189474582653462f30f2c644cf3463150de3275315c98d030204f26406aaed7
SSDEEP 96:mTfazwpJE7T1cmLUnM8WNkJ5h4IayGivkLzvCVuaNj22+S1XAEahAo9LiRHneN:UCwOBWJ5hDayV8Lb0Ng81QEEh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads