3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53

General

Target

3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe
Size

1.4MB
MD5

26baf2fbfd19fc2b3fdd3bfb9ccc94d0
SHA1

b956e2cc743f37cc07d68bbca6125575d55dcf5d
SHA256

3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53
SHA512

da130f671883287756eb2fd3163b907a1be8947f81e6a24880c06b762d5190b5ee5488a699319871aa2f48075de225e838377c5c0d92fd8702702a4a4509138f

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1980-55-0x0000000000160000-0x0000000000347000-memory.dmp	upx
behavioral1/memory/1980-58-0x0000000000160000-0x0000000000347000-memory.dmp	upx

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run	3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Runtime broker = "C:\\Users\\Admin\\AppData\\Roaming\\cvmkgeqxcl\\Runtime broker.exe"	3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/1980-55-0x0000000000160000-0x0000000000347000-memory.dmp	autoit_exe
behavioral1/memory/1980-58-0x0000000000160000-0x0000000000347000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe

NTFS ADS 1 IoCs

Processes:

3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\root\cimv2	3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe

pid process

1980 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

DllHost.exe

pid process

1728 DllHost.exe

pid	process
1980	3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe

pid	process
1728	DllHost.exe

C:\Users\Admin\AppData\Local\Temp\3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe
"C:\Users\Admin\AppData\Local\Temp\3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe"
1⤵
- Checks BIOS information in registry
- Adds Run key to start application
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: GetForegroundWindowSpam
PID:1980

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1728

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Mycanal.ico
Filesize
37KB

MD5
c25b40185e75f317542643bbb78fe69a

SHA1
adab3dab6424cd1921d979532f6a2589c95c76a3

SHA256
aa768cf5aa9a6711746afbe513fd024fd7b2c9a3529ede5c92fd5392b584288f

SHA512
e60b01bdd03d7e7b3e9b23ff7fe00e9e3a8405b8bc1c055c416ad9bd91da93a48a6b32679b74b671120ab75d465c1e6343363b6431322181db89ddc25e1f8dac

Download Submit
memory/1980-54-0x00000000768D1000-0x00000000768D3000-memory.dmp

Filesize
8KB

Download
memory/1980-55-0x0000000000160000-0x0000000000347000-memory.dmp

Filesize
1.9MB

Download
memory/1980-58-0x0000000000160000-0x0000000000347000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads