5f507220a2fb208b33df898298f0b10a9a11a2456c13817c1b38301cf675d71d

General

Target

5f507220a2fb208b33df898298f0b10a9a11a2456c13817c1b38301cf675d71d.exe
Size

53KB
MD5

09e33b705e043bc42dbb11fe0d27ec84
SHA1

8f1d2a7512d48526e226379d03ede80c9e1b7aff
SHA256

5f507220a2fb208b33df898298f0b10a9a11a2456c13817c1b38301cf675d71d
SHA512

d90237143b9ef840df1ceac6ceabe71e20efb4a0a88513377233371a954f3b76924a276ca353c497fe40e4e6eaf32206932778005bfe6ca676cbd8ffd114140e

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\AppDataLow = "C:\\Users\\Admin\\AppData\\Roaming\\C7A3AC.exe"	svchost.exe

Executes dropped EXE 2 IoCs

Processes:

PWxSk.execvtres.exe

pid process

2032 PWxSk.exe
1404 cvtres.exe

pid	process
2032	PWxSk.exe
1404	cvtres.exe

Loads dropped DLL 3 IoCs

Processes:

5f507220a2fb208b33df898298f0b10a9a11a2456c13817c1b38301cf675d71d.exePWxSk.exe

pid	process
1708	5f507220a2fb208b33df898298f0b10a9a11a2456c13817c1b38301cf675d71d.exe
1708	5f507220a2fb208b33df898298f0b10a9a11a2456c13817c1b38301cf675d71d.exe
2032	PWxSk.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

cvtres.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	cvtres.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	cvtres.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

PWxSk.exe

description pid process target process

PID 2032 set thread context of 1404 2032 PWxSk.exe cvtres.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

cvtres.exe

pid process

1404 cvtres.exe
1404 cvtres.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

PWxSk.exe

description pid process

Token: SeDebugPrivilege 2032 PWxSk.exe

description	pid	process	target process
PID 2032 set thread context of 1404	2032	PWxSk.exe	cvtres.exe

pid	process
1404	cvtres.exe
1404	cvtres.exe

description	pid	process
Token: SeDebugPrivilege	2032	PWxSk.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

5f507220a2fb208b33df898298f0b10a9a11a2456c13817c1b38301cf675d71d.exePWxSk.execvtres.exe

description	pid	process	target process
PID 1708 wrote to memory of 2032	1708	5f507220a2fb208b33df898298f0b10a9a11a2456c13817c1b38301cf675d71d.exe	PWxSk.exe
PID 1708 wrote to memory of 2032	1708	5f507220a2fb208b33df898298f0b10a9a11a2456c13817c1b38301cf675d71d.exe	PWxSk.exe
PID 1708 wrote to memory of 2032	1708	5f507220a2fb208b33df898298f0b10a9a11a2456c13817c1b38301cf675d71d.exe	PWxSk.exe
PID 1708 wrote to memory of 2032	1708	5f507220a2fb208b33df898298f0b10a9a11a2456c13817c1b38301cf675d71d.exe	PWxSk.exe
PID 2032 wrote to memory of 1404	2032	PWxSk.exe	cvtres.exe
PID 2032 wrote to memory of 1404	2032	PWxSk.exe	cvtres.exe
PID 2032 wrote to memory of 1404	2032	PWxSk.exe	cvtres.exe
PID 2032 wrote to memory of 1404	2032	PWxSk.exe	cvtres.exe
PID 2032 wrote to memory of 1404	2032	PWxSk.exe	cvtres.exe
PID 2032 wrote to memory of 1404	2032	PWxSk.exe	cvtres.exe
PID 2032 wrote to memory of 1404	2032	PWxSk.exe	cvtres.exe
PID 1404 wrote to memory of 1740	1404	cvtres.exe	svchost.exe
PID 1404 wrote to memory of 1740	1404	cvtres.exe	svchost.exe
PID 1404 wrote to memory of 1740	1404	cvtres.exe	svchost.exe
PID 1404 wrote to memory of 1740	1404	cvtres.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\5f507220a2fb208b33df898298f0b10a9a11a2456c13817c1b38301cf675d71d.exe
"C:\Users\Admin\AppData\Local\Temp\5f507220a2fb208b33df898298f0b10a9a11a2456c13817c1b38301cf675d71d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1708

C:\Users\Admin\AppData\Local\Temp\PWxSk.exe
"C:\Users\Admin\AppData\Local\Temp\PWxSk.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032

C:\Users\Admin\AppData\Local\Temp\cvtres.exe
C:\Users\Admin\AppData\Local\Temp\\cvtres.exe
3⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1404

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
- Adds policy Run key to start application
PID:1740

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\PWxSk.exe
Filesize
33KB

MD5
551b2b0d439629e2f8c611b50e4b78f9

SHA1
530aa7a73c778041d3234ca128b20ffa981685d5

SHA256
ad659dc13b7000df6d1f8bd2243432ee60f2830318295e82e7288b6d4e5c1e68

SHA512
32fee40ff6ce83d3f979f65f1c22cef0fbb51efa523021a3d53539b3ec28eb3184c97a3c51a307b0f72b938a6a0752e0e5a5f1fdda977df532aa6be18ba1d17e

Download Submit
C:\Users\Admin\AppData\Local\Temp\PWxSk.exe
Filesize
33KB

MD5
551b2b0d439629e2f8c611b50e4b78f9

SHA1
530aa7a73c778041d3234ca128b20ffa981685d5

SHA256
ad659dc13b7000df6d1f8bd2243432ee60f2830318295e82e7288b6d4e5c1e68

SHA512
32fee40ff6ce83d3f979f65f1c22cef0fbb51efa523021a3d53539b3ec28eb3184c97a3c51a307b0f72b938a6a0752e0e5a5f1fdda977df532aa6be18ba1d17e

Download Submit
C:\Users\Admin\AppData\Local\Temp\cvtres.exe
Filesize
31KB

MD5
ed797d8dc2c92401985d162e42ffa450

SHA1
0f02fc517c7facc4baefde4fe9467fb6488ebabe

SHA256
b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e

SHA512
e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\cvtres.exe
Filesize
31KB

MD5
ed797d8dc2c92401985d162e42ffa450

SHA1
0f02fc517c7facc4baefde4fe9467fb6488ebabe

SHA256
b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e

SHA512
e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

Download Submit
\Users\Admin\AppData\Local\Temp\PWxSk.exe
Filesize
33KB

MD5
551b2b0d439629e2f8c611b50e4b78f9

SHA1
530aa7a73c778041d3234ca128b20ffa981685d5

SHA256
ad659dc13b7000df6d1f8bd2243432ee60f2830318295e82e7288b6d4e5c1e68

SHA512
32fee40ff6ce83d3f979f65f1c22cef0fbb51efa523021a3d53539b3ec28eb3184c97a3c51a307b0f72b938a6a0752e0e5a5f1fdda977df532aa6be18ba1d17e

Download Submit
\Users\Admin\AppData\Local\Temp\PWxSk.exe
Filesize
33KB

MD5
551b2b0d439629e2f8c611b50e4b78f9

SHA1
530aa7a73c778041d3234ca128b20ffa981685d5

SHA256
ad659dc13b7000df6d1f8bd2243432ee60f2830318295e82e7288b6d4e5c1e68

SHA512
32fee40ff6ce83d3f979f65f1c22cef0fbb51efa523021a3d53539b3ec28eb3184c97a3c51a307b0f72b938a6a0752e0e5a5f1fdda977df532aa6be18ba1d17e

Download Submit
\Users\Admin\AppData\Local\Temp\cvtres.exe
Filesize
31KB

MD5
ed797d8dc2c92401985d162e42ffa450

SHA1
0f02fc517c7facc4baefde4fe9467fb6488ebabe

SHA256
b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e

SHA512
e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

Download Submit
memory/1404-66-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1404-70-0x000000000040345C-mapping.dmp

Download
memory/1404-75-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1404-73-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1404-67-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1404-69-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1708-55-0x0000000074750000-0x0000000074CFB000-memory.dmp

Filesize
5.7MB

Download
memory/1708-54-0x0000000075A61000-0x0000000075A63000-memory.dmp

Filesize
8KB

Download
memory/1708-56-0x0000000074750000-0x0000000074CFB000-memory.dmp

Filesize
5.7MB

Download
memory/1708-63-0x0000000074750000-0x0000000074CFB000-memory.dmp

Filesize
5.7MB

Download
memory/1740-74-0x0000000000000000-mapping.dmp

Download
memory/1740-78-0x0000000000B40000-0x0000000000B48000-memory.dmp

Filesize
32KB

Download
memory/1740-79-0x00000000000C0000-0x00000000000C4000-memory.dmp

Filesize
16KB

Download
memory/1740-80-0x0000000000030000-0x000000000003C000-memory.dmp

Filesize
48KB

Download
memory/1740-81-0x0000000000030000-0x000000000003C000-memory.dmp

Filesize
48KB

Download
memory/2032-72-0x0000000074750000-0x0000000074CFB000-memory.dmp

Filesize
5.7MB

Download
memory/2032-59-0x0000000000000000-mapping.dmp

Download
memory/2032-64-0x0000000074750000-0x0000000074CFB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads