169d79af3834f5f085f6a0db4e757708b581fb5cd324d0eb4d1ad1f18139ebe8

General

Target
169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe
Size 2.5MB
Sample220607-mt3gdshfdl
SHA256 169d79af3834f5f085f6a0db4e757708b581fb5cd324d0eb4d1ad1f18139ebe8
MD5 218f439c13442e468ba48ca747cef66a
SHA1 80952a76afa46f8da8ef593035640a02c68819d4
SHA512 fa27cbd2bb49a2d25ec7ec23f1cca02c7bbbe96f51a26474b330451af9597d8c055ed666eb284e213da3f673ccc96625d80128a2371bdaf4ee221c1a005ec219
MD5 SHA1 SHA512

Score

7^/10

discovery persistence

Malware Config

Signatures

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	223.5.5.5

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe"	169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1856	whoami.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 628	1700	169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe	27
PID 1700 wrote to memory of 628	1700	169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe	27
PID 1700 wrote to memory of 628	1700	169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe	27
PID 1700 wrote to memory of 628	1700	169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe	27
PID 1700 wrote to memory of 948	1700	169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe	28
PID 1700 wrote to memory of 948	1700	169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe	28
PID 1700 wrote to memory of 948	1700	169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe	28
PID 1700 wrote to memory of 948	1700	169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe	28
PID 948 wrote to memory of 1856	948	cmd.exe	30
PID 948 wrote to memory of 1856	948	cmd.exe	30
PID 948 wrote to memory of 1856	948	cmd.exe	30
PID 948 wrote to memory of 1856	948	cmd.exe	30
PID 1700 wrote to memory of 1120	1700	169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe	31
PID 1700 wrote to memory of 1120	1700	169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe	31
PID 1700 wrote to memory of 1120	1700	169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe	31
PID 1700 wrote to memory of 1120	1700	169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe	31
PID 1120 wrote to memory of 584	1120	cmd.exe	33
PID 1120 wrote to memory of 584	1120	cmd.exe	33
PID 1120 wrote to memory of 584	1120	cmd.exe	33
PID 1120 wrote to memory of 584	1120	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe
"C:\Users\Admin\AppData\Local\Temp\169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe
  "C:\Users\Admin\AppData\Local\Temp\169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe" dog 393244
  2⤵
  PID:628
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c whoami
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\SysWOW64\whoami.exe
    whoami
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1856
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c netsh wlan show profiles
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\SysWOW64\netsh.exe
    netsh wlan show profiles
    3⤵
    PID:584