3a2a1fba2bea5600fc52fe76f01962816a5389ad98821fd57589202709e85293

General

Target

3a2a1fba2bea5600fc52fe76f01962816a5389ad98821fd57589202709e85293.exe
Size

747KB
MD5

e9a2ea574bb733f7c75fc30e3f7172d3
SHA1

167142406d095748096461e215c56b92b2f28a0b
SHA256

3a2a1fba2bea5600fc52fe76f01962816a5389ad98821fd57589202709e85293
SHA512

e37ab5b6f66c1312bf3e20bbe75f4b97e3a665042172926424198b0df1be3bf601e6ce538678999ab390704d09f4c81f2f4d910430da11a71736b4a6d2f2315f
SSDEEP

12288:sEDCJJDXb8qWvvMyesvleMkWzChpBTfgYvVtcgwSuLnKtTPNr:smQGbvNvjkJPKuMlXer

Score

10^/10

persistence

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
batamjrsokky

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4660	GrandHigh V 0.5.EXE
1932	adobe reader.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	3a2a1fba2bea5600fc52fe76f01962816a5389ad98821fd57589202709e85293.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe"	adobe reader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\adobe reader.exe\""	adobe reader.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	whatismyip.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
1932	adobe reader.exe
1932	adobe reader.exe
4660	GrandHigh V 0.5.EXE
4660	GrandHigh V 0.5.EXE
4660	GrandHigh V 0.5.EXE
4660	GrandHigh V 0.5.EXE
4660	GrandHigh V 0.5.EXE
4660	GrandHigh V 0.5.EXE
4660	GrandHigh V 0.5.EXE
4660	GrandHigh V 0.5.EXE
1932	adobe reader.exe
1932	adobe reader.exe
1932	adobe reader.exe
4660	GrandHigh V 0.5.EXE
4660	GrandHigh V 0.5.EXE
4660	GrandHigh V 0.5.EXE
4660	GrandHigh V 0.5.EXE
4660	GrandHigh V 0.5.EXE
4660	GrandHigh V 0.5.EXE
4660	GrandHigh V 0.5.EXE
4660	GrandHigh V 0.5.EXE
4660	GrandHigh V 0.5.EXE
4660	GrandHigh V 0.5.EXE
4660	GrandHigh V 0.5.EXE
4660	GrandHigh V 0.5.EXE
4660	GrandHigh V 0.5.EXE
4660	GrandHigh V 0.5.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4660	GrandHigh V 0.5.EXE
Token: SeDebugPrivilege	1932	adobe reader.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1932	adobe reader.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1932	adobe reader.exe
1932	adobe reader.exe
1932	adobe reader.exe
1932	adobe reader.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 4660	3300	3a2a1fba2bea5600fc52fe76f01962816a5389ad98821fd57589202709e85293.exe	83
PID 3300 wrote to memory of 4660	3300	3a2a1fba2bea5600fc52fe76f01962816a5389ad98821fd57589202709e85293.exe	83
PID 3300 wrote to memory of 4660	3300	3a2a1fba2bea5600fc52fe76f01962816a5389ad98821fd57589202709e85293.exe	83
PID 3300 wrote to memory of 1932	3300	3a2a1fba2bea5600fc52fe76f01962816a5389ad98821fd57589202709e85293.exe	84
PID 3300 wrote to memory of 1932	3300	3a2a1fba2bea5600fc52fe76f01962816a5389ad98821fd57589202709e85293.exe	84

C:\Users\Admin\AppData\Local\Temp\3a2a1fba2bea5600fc52fe76f01962816a5389ad98821fd57589202709e85293.exe
"C:\Users\Admin\AppData\Local\Temp\3a2a1fba2bea5600fc52fe76f01962816a5389ad98821fd57589202709e85293.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Users\Admin\AppData\Local\Temp\GrandHigh V 0.5.EXE
  "C:\Users\Admin\AppData\Local\Temp\GrandHigh V 0.5.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4660
- C:\Users\Admin\AppData\Local\Temp\adobe reader.exe
  "C:\Users\Admin\AppData\Local\Temp\adobe reader.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:1932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\GrandHigh V 0.5.EXE

Filesize
691KB

MD5
4d1f2a41a50fd8573cd62d4782891ed4

SHA1
31ea79826d9073d3f03ad1fcedfb36e036f3b06a

SHA256
e530fc3183248732fc5b6c11155d82bf5525dfd31b8653d94b9b6435208bf58c

SHA512
dec0daf968e126c5c2feb53e26da104725a61e77acc4f56c20a75253c8489b63b66a6758263d2d3eb8db68bde5c98fc70e782bca30988c3998c61f1a1ccf8398

Download Submit
C:\Users\Admin\AppData\Local\Temp\GrandHigh V 0.5.EXE

Filesize
691KB

MD5
4d1f2a41a50fd8573cd62d4782891ed4

SHA1
31ea79826d9073d3f03ad1fcedfb36e036f3b06a

SHA256
e530fc3183248732fc5b6c11155d82bf5525dfd31b8653d94b9b6435208bf58c

SHA512
dec0daf968e126c5c2feb53e26da104725a61e77acc4f56c20a75253c8489b63b66a6758263d2d3eb8db68bde5c98fc70e782bca30988c3998c61f1a1ccf8398

Download Submit
C:\Users\Admin\AppData\Local\Temp\adobe reader.exe

Filesize
36KB

MD5
2e3cc371e73b3773e03612712db17f94

SHA1
e2fb40ac723b4094fa49fdd4115c819c8248a43c

SHA256
7abd25d2f542817d993046743e5523f31ab5eeb545897075c514d9b40f5c9fb2

SHA512
efeda873ee73a774c9ad5d803e97ba58d96375292eafb8e52ab781ba869facacc59c6e84749c55327a67e34d433bcd3f0f1f5ef1c7b2af3389c369b76f27f9c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\adobe reader.exe

Filesize
36KB

MD5
2e3cc371e73b3773e03612712db17f94

SHA1
e2fb40ac723b4094fa49fdd4115c819c8248a43c

SHA256
7abd25d2f542817d993046743e5523f31ab5eeb545897075c514d9b40f5c9fb2

SHA512
efeda873ee73a774c9ad5d803e97ba58d96375292eafb8e52ab781ba869facacc59c6e84749c55327a67e34d433bcd3f0f1f5ef1c7b2af3389c369b76f27f9c3

Download Submit
memory/1932-139-0x00007FF99B120000-0x00007FF99BB56000-memory.dmp

Filesize
10.2MB

Download
memory/1932-141-0x00000000011EA000-0x00000000011EF000-memory.dmp

Filesize
20KB

Download
memory/1932-142-0x00000000011EA000-0x00000000011EF000-memory.dmp

Filesize
20KB

Download
memory/1932-143-0x0000000021D30000-0x0000000021D33000-memory.dmp

Filesize
12KB

Download
memory/3300-132-0x00007FF99B120000-0x00007FF99BB56000-memory.dmp

Filesize
10.2MB

Download

Analysis

Sharing