2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5

General

Target

2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe
Size

422KB
MD5

013d6eee4b2eb9bd2e2e69ee6c9779a0
SHA1

dd0895b1ba4c68d5d0f36871b8baa24a27170b81
SHA256

2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5
SHA512

00efb8b02f768ead720465db167d14b57fa5e47f033903894923f63a1b9293d6375b8c2b2aa02405fe174dea52748d928d783d98468d2af6dd5de62254ad0f92
SSDEEP

6144:Hg+rlLS38zaweJt/izJ2vFAWBb+WmsoD+h+nyjfoNHO05gWA6fzbUm7:H1QkawCCJSmWR9/heeolO05/rl

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe
File created	C:\Windows\System32\drivers\etc\hosts.ics	2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 2 IoCs

evasion

pid	Process
1888	taskkill.exe
1912	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	RunDll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	RunDll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1000	2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe
1000	2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe
1000	2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe
1000	2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe
1000	2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe
1000	2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe
1000	2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe
1000	2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe
1000	2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe
1000	2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1888	taskkill.exe
Token: SeDebugPrivilege	1912	taskkill.exe
Token: 33	1680	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1680	AUDIODG.EXE
Token: 33	1680	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1680	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1000	2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe
936	RunDll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1000	2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe
1000	2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe
1000	2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 1888	1000	2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe	27
PID 1000 wrote to memory of 1888	1000	2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe	27
PID 1000 wrote to memory of 1888	1000	2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe	27
PID 1000 wrote to memory of 1888	1000	2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe	27
PID 1000 wrote to memory of 936	1000	2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe	31
PID 1000 wrote to memory of 936	1000	2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe	31
PID 1000 wrote to memory of 936	1000	2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe	31
PID 1000 wrote to memory of 936	1000	2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe	31
PID 1000 wrote to memory of 936	1000	2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe	31
PID 1000 wrote to memory of 936	1000	2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe	31
PID 1000 wrote to memory of 936	1000	2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe	31
PID 1000 wrote to memory of 1912	1000	2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe	33
PID 1000 wrote to memory of 1912	1000	2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe	33
PID 1000 wrote to memory of 1912	1000	2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe	33
PID 1000 wrote to memory of 1912	1000	2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe	33

C:\Users\Admin\AppData\Local\Temp\2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe
"C:\Users\Admin\AppData\Local\Temp\2cb9b86f81d6cab77474b43fdda1eb693f3f282b476cfcbfeb76c9f46f223ab5.exe"
1⤵
- Drops file in Drivers directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im lsas.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1888
- C:\Windows\SysWOW64\RunDll32.exe
  RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  PID:936
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im lsas.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1912

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x484
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/936-60-0x0000000072511000-0x0000000072513000-memory.dmp

Filesize
8KB

Download
memory/1000-57-0x0000000076561000-0x0000000076563000-memory.dmp

Filesize
8KB

Download
memory/1000-61-0x0000000003C51000-0x0000000004AFD000-memory.dmp

Filesize
14.7MB

Download

Analysis

Sharing