26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db | Triage

Analysis

max time kernel
153s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
16-06-2022 07:17

Sharing

Report Analysis Logs

General

Target

26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe
Size

818KB
MD5

05e074a8fd3672396b4a9f2a271ba17d
SHA1

82e1890207edee593eeda5133024f88e42a41486
SHA256

26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db
SHA512

fbadd65c6d788bcb40a6316e1762563b7a9c3908b8e1b28efa1fba5274adf60d2858cee4fc34555ae034455a32559162331b059bad49abcdd1341f28b247413f

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\26443 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\msqkisq.com"	svchost.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

Processes:

26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe

description	pid	process	target process
PID 2548 set thread context of 3764	2548	26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe	26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe

Drops file in Program Files directory 1 IoCs

Processes:

svchost.exe

description ioc process

File created C:\PROGRA~3\LOCALS~1\Temp\msqkisq.com svchost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe

pid	process
3764	26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe
3764	26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe

pid	process
3764	26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe
3764	26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe

pid	process
2548	26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe
2548	26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe
2548	26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe

pid	process
2548	26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe
2548	26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe
2548	26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe

description	pid	process	target process
PID 2548 wrote to memory of 3764	2548	26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe	26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe
PID 2548 wrote to memory of 3764	2548	26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe	26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe
PID 2548 wrote to memory of 3764	2548	26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe	26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe
PID 2548 wrote to memory of 3764	2548	26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe	26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe
PID 2548 wrote to memory of 3764	2548	26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe	26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe
PID 3764 wrote to memory of 3276	3764	26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe	svchost.exe
PID 3764 wrote to memory of 3276	3764	26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe	svchost.exe
PID 3764 wrote to memory of 3276	3764	26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe
"C:\Users\Admin\AppData\Local\Temp\26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Users\Admin\AppData\Local\Temp\26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe
  "C:\Users\Admin\AppData\Local\Temp\26cc8372a4e8eeb5f03f03d1b86b8e308c6f45552cbd42dc1ecbf8ccc7d1e0db.exe"
  2⤵
  - Maps connected drives based on registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3764
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    - Adds policy Run key to start application
    - Drops file in Program Files directory
    PID:3276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3276-132-0x0000000000000000-mapping.dmp

Download
memory/3276-133-0x0000000000550000-0x000000000055E000-memory.dmp

Filesize
56KB

Download
memory/3276-134-0x0000000000590000-0x0000000000595000-memory.dmp

Filesize
20KB

Download
memory/3276-135-0x0000000000590000-0x0000000000595000-memory.dmp

Filesize
20KB

Download
memory/3764-130-0x0000000000000000-mapping.dmp

Download
memory/3764-131-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download