59e02dea77ea89b913bb8552b5c34009f7b84a04a4c61524c42ee3edccf06e3c

General

Target

5604f7e7a7ec0b2a91c80bac6e4ce7e3.exe
Size

25KB
MD5

5604f7e7a7ec0b2a91c80bac6e4ce7e3
SHA1

de20822d458b1fdd421260e5e42ce4888b6315c1
SHA256

59e02dea77ea89b913bb8552b5c34009f7b84a04a4c61524c42ee3edccf06e3c
SHA512

830b1764256bdfd255c7fcfa90bd278a7790e295416ed972bcb71014ed688b8cc5466e5dc223c32984d40a5dee755b2f305d0c726ce80514e8e73e919e441e8e
SSDEEP

384:sv3ZIgUhKIQ27JJGYtSfcGUxIpRGOmBeqEiVcp0F9h2HbmdPvo8I6CQAbqLKkVLl:svpkhJ7tCgcRG1kpwgwvj1CNqXV6U6m

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

dllhost.exeServer.exeServer.exe

pid process

3304 dllhost.exe
3796 Server.exe
2856 Server.exe

pid	process
3304	dllhost.exe
3796	Server.exe
2856	Server.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5604f7e7a7ec0b2a91c80bac6e4ce7e3.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	5604f7e7a7ec0b2a91c80bac6e4ce7e3.exe

Drops startup file 2 IoCs

Processes:

dllhost.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftEnginee.exe	dllhost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftEnginee.exe	dllhost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

dllhost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsEnginee = "\"C:\\Users\\Admin\\AppData\\Roaming\\dllhost.exe\" .."	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsEnginee = "\"C:\\Users\\Admin\\AppData\\Roaming\\dllhost.exe\" .."	dllhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3616 schtasks.exe
Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

5604f7e7a7ec0b2a91c80bac6e4ce7e3.exedllhost.exe

pid process

1584 5604f7e7a7ec0b2a91c80bac6e4ce7e3.exe
3304 dllhost.exe

pid	process
3616	schtasks.exe

pid	process
1584	5604f7e7a7ec0b2a91c80bac6e4ce7e3.exe
3304	dllhost.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

Processes:

dllhost.exe

description	pid	process
Token: SeDebugPrivilege	3304	dllhost.exe
Token: 33	3304	dllhost.exe
Token: SeIncBasePriorityPrivilege	3304	dllhost.exe
Token: 33	3304	dllhost.exe
Token: SeIncBasePriorityPrivilege	3304	dllhost.exe
Token: 33	3304	dllhost.exe
Token: SeIncBasePriorityPrivilege	3304	dllhost.exe
Token: 33	3304	dllhost.exe
Token: SeIncBasePriorityPrivilege	3304	dllhost.exe
Token: 33	3304	dllhost.exe
Token: SeIncBasePriorityPrivilege	3304	dllhost.exe
Token: 33	3304	dllhost.exe
Token: SeIncBasePriorityPrivilege	3304	dllhost.exe
Token: 33	3304	dllhost.exe
Token: SeIncBasePriorityPrivilege	3304	dllhost.exe
Token: 33	3304	dllhost.exe
Token: SeIncBasePriorityPrivilege	3304	dllhost.exe
Token: 33	3304	dllhost.exe
Token: SeIncBasePriorityPrivilege	3304	dllhost.exe
Token: 33	3304	dllhost.exe
Token: SeIncBasePriorityPrivilege	3304	dllhost.exe
Token: 33	3304	dllhost.exe
Token: SeIncBasePriorityPrivilege	3304	dllhost.exe
Token: 33	3304	dllhost.exe
Token: SeIncBasePriorityPrivilege	3304	dllhost.exe
Token: 33	3304	dllhost.exe
Token: SeIncBasePriorityPrivilege	3304	dllhost.exe
Token: 33	3304	dllhost.exe
Token: SeIncBasePriorityPrivilege	3304	dllhost.exe
Token: 33	3304	dllhost.exe
Token: SeIncBasePriorityPrivilege	3304	dllhost.exe
Token: 33	3304	dllhost.exe
Token: SeIncBasePriorityPrivilege	3304	dllhost.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5604f7e7a7ec0b2a91c80bac6e4ce7e3.exedllhost.exe

description	pid	process	target process
PID 1584 wrote to memory of 3304	1584	5604f7e7a7ec0b2a91c80bac6e4ce7e3.exe	dllhost.exe
PID 1584 wrote to memory of 3304	1584	5604f7e7a7ec0b2a91c80bac6e4ce7e3.exe	dllhost.exe
PID 3304 wrote to memory of 3616	3304	dllhost.exe	schtasks.exe
PID 3304 wrote to memory of 3616	3304	dllhost.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\5604f7e7a7ec0b2a91c80bac6e4ce7e3.exe
"C:\Users\Admin\AppData\Local\Temp\5604f7e7a7ec0b2a91c80bac6e4ce7e3.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1584

C:\Users\Admin\AppData\Roaming\dllhost.exe
"C:\Users\Admin\AppData\Roaming\dllhost.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3304

C:\Windows\SYSTEM32\schtasks.exe
schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe
3⤵
- Creates scheduled task(s)
PID:3616

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
PID:3796

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
PID:2856

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Server.exe.log
Filesize
1KB

MD5
a8a147915e3a996fdbe10b3a3f1e1bb2

SHA1
abc564c1be468d57e700913e7b6cf8f62d421263

SHA256
8b96a8557deea66696837af011843d6a82451ba57c8f9b5a2726a70818d6fc7e

SHA512
17b42f17ef60a9f625703172763f692e5ed2ca93564a97853dfa72bb0ac6305ef3267aea0b205938e3aa8eac10156d9d4f322b30d0329d92d647bcec6372731c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Server.exe
Filesize
25KB

MD5
5604f7e7a7ec0b2a91c80bac6e4ce7e3

SHA1
de20822d458b1fdd421260e5e42ce4888b6315c1

SHA256
59e02dea77ea89b913bb8552b5c34009f7b84a04a4c61524c42ee3edccf06e3c

SHA512
830b1764256bdfd255c7fcfa90bd278a7790e295416ed972bcb71014ed688b8cc5466e5dc223c32984d40a5dee755b2f305d0c726ce80514e8e73e919e441e8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Server.exe
Filesize
25KB

MD5
5604f7e7a7ec0b2a91c80bac6e4ce7e3

SHA1
de20822d458b1fdd421260e5e42ce4888b6315c1

SHA256
59e02dea77ea89b913bb8552b5c34009f7b84a04a4c61524c42ee3edccf06e3c

SHA512
830b1764256bdfd255c7fcfa90bd278a7790e295416ed972bcb71014ed688b8cc5466e5dc223c32984d40a5dee755b2f305d0c726ce80514e8e73e919e441e8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Server.exe
Filesize
25KB

MD5
5604f7e7a7ec0b2a91c80bac6e4ce7e3

SHA1
de20822d458b1fdd421260e5e42ce4888b6315c1

SHA256
59e02dea77ea89b913bb8552b5c34009f7b84a04a4c61524c42ee3edccf06e3c

SHA512
830b1764256bdfd255c7fcfa90bd278a7790e295416ed972bcb71014ed688b8cc5466e5dc223c32984d40a5dee755b2f305d0c726ce80514e8e73e919e441e8e

Download Submit
C:\Users\Admin\AppData\Roaming\dllhost.exe
Filesize
25KB

MD5
5604f7e7a7ec0b2a91c80bac6e4ce7e3

SHA1
de20822d458b1fdd421260e5e42ce4888b6315c1

SHA256
59e02dea77ea89b913bb8552b5c34009f7b84a04a4c61524c42ee3edccf06e3c

SHA512
830b1764256bdfd255c7fcfa90bd278a7790e295416ed972bcb71014ed688b8cc5466e5dc223c32984d40a5dee755b2f305d0c726ce80514e8e73e919e441e8e

Download Submit
C:\Users\Admin\AppData\Roaming\dllhost.exe
Filesize
25KB

MD5
5604f7e7a7ec0b2a91c80bac6e4ce7e3

SHA1
de20822d458b1fdd421260e5e42ce4888b6315c1

SHA256
59e02dea77ea89b913bb8552b5c34009f7b84a04a4c61524c42ee3edccf06e3c

SHA512
830b1764256bdfd255c7fcfa90bd278a7790e295416ed972bcb71014ed688b8cc5466e5dc223c32984d40a5dee755b2f305d0c726ce80514e8e73e919e441e8e

Download Submit
memory/1584-136-0x00007FFCEEAE0000-0x00007FFCEF5A1000-memory.dmp

Filesize
10.8MB

Download
memory/1584-140-0x00007FFCEEAE0000-0x00007FFCEF5A1000-memory.dmp

Filesize
10.8MB

Download
memory/1584-135-0x0000000000580000-0x0000000000588000-memory.dmp

Filesize
32KB

Download
memory/2856-151-0x00007FFCEEAE0000-0x00007FFCEF5A1000-memory.dmp

Filesize
10.8MB

Download
memory/2856-150-0x00007FFCEEAE0000-0x00007FFCEF5A1000-memory.dmp

Filesize
10.8MB

Download
memory/3304-143-0x00007FFCEEAE0000-0x00007FFCEF5A1000-memory.dmp

Filesize
10.8MB

Download
memory/3304-141-0x00007FFCEEAE0000-0x00007FFCEF5A1000-memory.dmp

Filesize
10.8MB

Download
memory/3304-137-0x0000000000000000-mapping.dmp

Download
memory/3616-142-0x0000000000000000-mapping.dmp

Download
memory/3796-147-0x00007FFCEEAE0000-0x00007FFCEF5A1000-memory.dmp

Filesize
10.8MB

Download
memory/3796-146-0x00007FFCEEAE0000-0x00007FFCEF5A1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads