169d79af3834f5f085f6a0db4e757708b581fb5cd324d0eb4d1ad1f18139ebe8

General

Target
169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe
Size 2.5MB
Sample220607-mt3gdshfdl
SHA256 169d79af3834f5f085f6a0db4e757708b581fb5cd324d0eb4d1ad1f18139ebe8
MD5 218f439c13442e468ba48ca747cef66a
SHA1 80952a76afa46f8da8ef593035640a02c68819d4
SHA512 fa27cbd2bb49a2d25ec7ec23f1cca02c7bbbe96f51a26474b330451af9597d8c055ed666eb284e213da3f673ccc96625d80128a2371bdaf4ee221c1a005ec219
MD5 SHA1 SHA512

Score

7^/10

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe"	169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2228	whoami.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 1048	2368	169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe	79
PID 2368 wrote to memory of 1048	2368	169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe	79
PID 2368 wrote to memory of 1048	2368	169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe	79
PID 2368 wrote to memory of 3188	2368	169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe	82
PID 2368 wrote to memory of 3188	2368	169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe	82
PID 2368 wrote to memory of 3188	2368	169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe	82
PID 3188 wrote to memory of 2228	3188	cmd.exe	84
PID 3188 wrote to memory of 2228	3188	cmd.exe	84
PID 3188 wrote to memory of 2228	3188	cmd.exe	84
PID 2368 wrote to memory of 4584	2368	169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe	85
PID 2368 wrote to memory of 4584	2368	169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe	85
PID 2368 wrote to memory of 4584	2368	169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe	85
PID 4584 wrote to memory of 4776	4584	cmd.exe	87
PID 4584 wrote to memory of 4776	4584	cmd.exe	87
PID 4584 wrote to memory of 4776	4584	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe
"C:\Users\Admin\AppData\Local\Temp\169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe
  "C:\Users\Admin\AppData\Local\Temp\169D79AF3834F5F085F6A0DB4E757708B581FB5CD324D0EB4D1AD1F18139EBE8.exe" dog 131542
  2⤵
  PID:1048
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c whoami
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3188
- - C:\Windows\SysWOW64\whoami.exe
    whoami
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2228
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c netsh wlan show profiles
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Windows\SysWOW64\netsh.exe
    netsh wlan show profiles
    3⤵
    PID:4776