24cf939935dedc5f2abf77799581f6d2689e2e46486d16db23f921f4195c704f

General

Target

24cf939935dedc5f2abf77799581f6d2689e2e46486d16db23f921f4195c704f.exe
Size

182KB
MD5

ecd9d90bd2695531c62882ccf14184ee
SHA1

bf6f84b7fcb5ca047a16dc45349d967ecdce888c
SHA256

24cf939935dedc5f2abf77799581f6d2689e2e46486d16db23f921f4195c704f
SHA512

920af48a8d7bd17526921f90c2bb733dfc6d98e68866be5c2d0a09173d3c7f35822d6a85723edc99fe0c7655204bd61ec128f5e5248f175843feb38a1d16a37c

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 5 IoCs

Processes:

24cf939935dedc5f2abf77799581f6d2689e2e46486d16db23f921f4195c704f.exe

pid	process
2692	24cf939935dedc5f2abf77799581f6d2689e2e46486d16db23f921f4195c704f.exe
2692	24cf939935dedc5f2abf77799581f6d2689e2e46486d16db23f921f4195c704f.exe
2692	24cf939935dedc5f2abf77799581f6d2689e2e46486d16db23f921f4195c704f.exe
2692	24cf939935dedc5f2abf77799581f6d2689e2e46486d16db23f921f4195c704f.exe
2692	24cf939935dedc5f2abf77799581f6d2689e2e46486d16db23f921f4195c704f.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

24cf939935dedc5f2abf77799581f6d2689e2e46486d16db23f921f4195c704f.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	24cf939935dedc5f2abf77799581f6d2689e2e46486d16db23f921f4195c704f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsREG = "C:\\Windows\\Temp\\wowreg32.exe"	24cf939935dedc5f2abf77799581f6d2689e2e46486d16db23f921f4195c704f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\24cf939935dedc5f2abf77799581f6d2689e2e46486d16db23f921f4195c704f.exe
"C:\Users\Admin\AppData\Local\Temp\24cf939935dedc5f2abf77799581f6d2689e2e46486d16db23f921f4195c704f.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
PID:2692

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nscF439.tmp\System.dll
Filesize
11KB

MD5
b8992e497d57001ddf100f9c397fcef5

SHA1
e26ddf101a2ec5027975d2909306457c6f61cfbd

SHA256
98bcd1dd88642f4dd36a300c76ebb1ddfbbbc5bfc7e3b6d7435dc6d6e030c13b

SHA512
8823b1904dccfaf031068102cb1def7958a057f49ff369f0e061f1b4db2090021aa620bb8442a2a6ac9355bb74ee54371dc2599c20dc723755a46ede81533a3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscF439.tmp\blowfish.dll
Filesize
26KB

MD5
a0a4fc162c9876660aae6d06008aa0a2

SHA1
c2bb69b4960660ebf8b8bafcad20a5eeb859a17b

SHA256
52b8e1f958fd0a352b7a9192d73a72d1c32711ff1740ded3e80009eb44d48575

SHA512
426f2c1cd52b1f0619f85c476f790b30ced912e31740fe7450dab9ed189d840b635e67ab05310269b1534d02be4afd885f952d4a231df6c232bae4313503c4ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscF439.tmp\blowfish.dll
Filesize
26KB

MD5
a0a4fc162c9876660aae6d06008aa0a2

SHA1
c2bb69b4960660ebf8b8bafcad20a5eeb859a17b

SHA256
52b8e1f958fd0a352b7a9192d73a72d1c32711ff1740ded3e80009eb44d48575

SHA512
426f2c1cd52b1f0619f85c476f790b30ced912e31740fe7450dab9ed189d840b635e67ab05310269b1534d02be4afd885f952d4a231df6c232bae4313503c4ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscF439.tmp\inetc.dll
Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscF439.tmp\inetc.dll
Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit

Analysis

Sharing