cffd3df34ac1f4d1f1d26ecb3cd70f7105e58e8ebbbf109c6a4c714af953a187

General

Target

cffd3df34ac1f4d1f1d26ecb3cd70f7105e58e8ebbbf109c6a4c714af953a187.exe
Size

44KB
MD5

74db805a82e2c06fbe2c2fb9e844453c
SHA1

40a7a2346623a30a6da2f9d09306af394e3c2db6
SHA256

cffd3df34ac1f4d1f1d26ecb3cd70f7105e58e8ebbbf109c6a4c714af953a187
SHA512

d856ac3eb9843c76252fb65de3d5f199b626a45e829e0e779d033b52cfd46747340802cac2246afe212f4fd97a0ae613e51c2518d35fd6e5d4a33c1623eff462
SSDEEP

768:75TBRYoWYexSbfbqC2z56YUw/DzEq+aJe1mgawzxsUNCub8PC1jIHxATVGuBMGq:7v+vzSjbJ2FTUwX1+aJe1mgawzxsBubw

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2844	regsvr32.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{7M8A6G00-3I18-11C0-821H-444200140P0S}	cffd3df34ac1f4d1f1d26ecb3cd70f7105e58e8ebbbf109c6a4c714af953a187.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7M8A6G00-3I18-11C0-821H-444200140P0S}\StubPath = "C:\\Windows\\system32\\OLE32Init.exe"	cffd3df34ac1f4d1f1d26ecb3cd70f7105e58e8ebbbf109c6a4c714af953a187.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{7M8A6G00-3I18-11C0-821H-444200140P0S}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7M8A6G00-3I18-11C0-821H-444200140P0S}\StubPath = "C:\\Windows\\system32\\OLE32Init.exe"	regsvr32.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	cffd3df34ac1f4d1f1d26ecb3cd70f7105e58e8ebbbf109c6a4c714af953a187.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\OLE32Init.exe	cffd3df34ac1f4d1f1d26ecb3cd70f7105e58e8ebbbf109c6a4c714af953a187.exe
File created	C:\Windows\SysWOW64\OLE32Init.exe	cffd3df34ac1f4d1f1d26ecb3cd70f7105e58e8ebbbf109c6a4c714af953a187.exe
File opened for modification	C:\Windows\SysWOW64\New Text Document.txt	cffd3df34ac1f4d1f1d26ecb3cd70f7105e58e8ebbbf109c6a4c714af953a187.exe
File created	C:\Windows\SysWOW64\New Text Document.txt	cffd3df34ac1f4d1f1d26ecb3cd70f7105e58e8ebbbf109c6a4c714af953a187.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\regsvr32.exe	cffd3df34ac1f4d1f1d26ecb3cd70f7105e58e8ebbbf109c6a4c714af953a187.exe
File created	C:\Windows\regsvr32.exe	cffd3df34ac1f4d1f1d26ecb3cd70f7105e58e8ebbbf109c6a4c714af953a187.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cffd3df34ac1f4d1f1d26ecb3cd70f7105e58e8ebbbf109c6a4c714af953a187.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2844	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 4364	4988	cffd3df34ac1f4d1f1d26ecb3cd70f7105e58e8ebbbf109c6a4c714af953a187.exe	78
PID 4988 wrote to memory of 4364	4988	cffd3df34ac1f4d1f1d26ecb3cd70f7105e58e8ebbbf109c6a4c714af953a187.exe	78
PID 4988 wrote to memory of 4364	4988	cffd3df34ac1f4d1f1d26ecb3cd70f7105e58e8ebbbf109c6a4c714af953a187.exe	78
PID 4988 wrote to memory of 2844	4988	cffd3df34ac1f4d1f1d26ecb3cd70f7105e58e8ebbbf109c6a4c714af953a187.exe	79
PID 4988 wrote to memory of 2844	4988	cffd3df34ac1f4d1f1d26ecb3cd70f7105e58e8ebbbf109c6a4c714af953a187.exe	79
PID 4988 wrote to memory of 2844	4988	cffd3df34ac1f4d1f1d26ecb3cd70f7105e58e8ebbbf109c6a4c714af953a187.exe	79

C:\Users\Admin\AppData\Local\Temp\cffd3df34ac1f4d1f1d26ecb3cd70f7105e58e8ebbbf109c6a4c714af953a187.exe
"C:\Users\Admin\AppData\Local\Temp\cffd3df34ac1f4d1f1d26ecb3cd70f7105e58e8ebbbf109c6a4c714af953a187.exe"
1⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Windows\system32\New Text Document.txt
  2⤵
  PID:4364
- C:\Windows\regsvr32.exe
  C:\Windows\regsvr32.exe
  2⤵
  - Executes dropped EXE
  - Modifies Installed Components in the registry
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\OLE32Init.exe

Filesize
44KB

MD5
c83bcb1cb436e0166d25620564a29681

SHA1
9b2d61dd27abcf26330d00dcdf1744df9c95e7fa

SHA256
2dea377e55b4c56fdfcfd8c44d295a958b792b85c08dd0c2575dd132b0180e96

SHA512
b0c235a70e643a38a197582a90d80dc68c922650a7b2192fc4b4edce9180d46cb6e78ac8359569d18e90ab48ddc266be9c48de9c6be95fe4c42a34479c34d812

Download Submit
C:\Windows\regsvr32.exe

Filesize
44KB

MD5
c83bcb1cb436e0166d25620564a29681

SHA1
9b2d61dd27abcf26330d00dcdf1744df9c95e7fa

SHA256
2dea377e55b4c56fdfcfd8c44d295a958b792b85c08dd0c2575dd132b0180e96

SHA512
b0c235a70e643a38a197582a90d80dc68c922650a7b2192fc4b4edce9180d46cb6e78ac8359569d18e90ab48ddc266be9c48de9c6be95fe4c42a34479c34d812

Download Submit
C:\Windows\regsvr32.exe

Filesize
44KB

MD5
c83bcb1cb436e0166d25620564a29681

SHA1
9b2d61dd27abcf26330d00dcdf1744df9c95e7fa

SHA256
2dea377e55b4c56fdfcfd8c44d295a958b792b85c08dd0c2575dd132b0180e96

SHA512
b0c235a70e643a38a197582a90d80dc68c922650a7b2192fc4b4edce9180d46cb6e78ac8359569d18e90ab48ddc266be9c48de9c6be95fe4c42a34479c34d812

Download Submit
memory/2844-141-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4988-132-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4988-133-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4988-138-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing