2c8406cceb353bae116d283f3aea53862bdad900f49bd33583cdab6df036c99d

General

Target

2c8406cceb353bae116d283f3aea53862bdad900f49bd33583cdab6df036c99d.exe
Size

809KB
MD5

027c75ff36cefd1a2fa149748e4a3861
SHA1

c753ed6bea73f2aa39721a6ad15a22c82d6e3024
SHA256

2c8406cceb353bae116d283f3aea53862bdad900f49bd33583cdab6df036c99d
SHA512

d36d6f19c28c252d563edb57d58c49c0a25f3ac523d3cddff97ca5ef7fb2e6520148128ad2776427bbb44fd5a4ab0599086a1cd8e35093cbcde3c26aa3daf8ce
SSDEEP

12288:L++ZN1QhEj0FK1e7fW+fFc7JpOpCZf2mKGubY354PE3u1YV6SU3Z3CssE7CyJdn9:XnehAzeLDFWtZf2hPE3ww6Zp3N66i

Score

8^/10

bootkit persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

privacy.exe

pid process

844 privacy.exe

Loads dropped DLL 3 IoCs

Processes:

2c8406cceb353bae116d283f3aea53862bdad900f49bd33583cdab6df036c99d.exe

pid	process
704	2c8406cceb353bae116d283f3aea53862bdad900f49bd33583cdab6df036c99d.exe
704	2c8406cceb353bae116d283f3aea53862bdad900f49bd33583cdab6df036c99d.exe
704	2c8406cceb353bae116d283f3aea53862bdad900f49bd33583cdab6df036c99d.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

privacy.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Privacy Protection = "C:\\ProgramData\\privacy.exe"	privacy.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	privacy.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

privacy.exe

description	ioc	process
File opened (read-only)	\??\P:	privacy.exe
File opened (read-only)	\??\T:	privacy.exe
File opened (read-only)	\??\E:	privacy.exe
File opened (read-only)	\??\G:	privacy.exe
File opened (read-only)	\??\K:	privacy.exe
File opened (read-only)	\??\O:	privacy.exe
File opened (read-only)	\??\R:	privacy.exe
File opened (read-only)	\??\V:	privacy.exe
File opened (read-only)	\??\Y:	privacy.exe
File opened (read-only)	\??\F:	privacy.exe
File opened (read-only)	\??\H:	privacy.exe
File opened (read-only)	\??\J:	privacy.exe
File opened (read-only)	\??\U:	privacy.exe
File opened (read-only)	\??\X:	privacy.exe
File opened (read-only)	\??\M:	privacy.exe
File opened (read-only)	\??\N:	privacy.exe
File opened (read-only)	\??\Q:	privacy.exe
File opened (read-only)	\??\W:	privacy.exe
File opened (read-only)	\??\Z:	privacy.exe
File opened (read-only)	\??\I:	privacy.exe
File opened (read-only)	\??\L:	privacy.exe
File opened (read-only)	\??\S:	privacy.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

privacy.exe

description ioc process

File opened for modification \??\PhysicalDrive0 privacy.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	\??\PhysicalDrive0	privacy.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

2c8406cceb353bae116d283f3aea53862bdad900f49bd33583cdab6df036c99d.exeprivacy.exe

pid	process
704	2c8406cceb353bae116d283f3aea53862bdad900f49bd33583cdab6df036c99d.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

2c8406cceb353bae116d283f3aea53862bdad900f49bd33583cdab6df036c99d.exe

pid process

704 2c8406cceb353bae116d283f3aea53862bdad900f49bd33583cdab6df036c99d.exe

Suspicious use of FindShellTrayWindow 11 IoCs

Processes:

privacy.exe

pid	process
844	privacy.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe

Suspicious use of SendNotifyMessage 11 IoCs

Processes:

privacy.exe

pid	process
844	privacy.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe
844	privacy.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

privacy.exe

pid process

844 privacy.exe
844 privacy.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2c8406cceb353bae116d283f3aea53862bdad900f49bd33583cdab6df036c99d.exe

description	pid	process	target process
PID 704 wrote to memory of 844	704	2c8406cceb353bae116d283f3aea53862bdad900f49bd33583cdab6df036c99d.exe	privacy.exe
PID 704 wrote to memory of 844	704	2c8406cceb353bae116d283f3aea53862bdad900f49bd33583cdab6df036c99d.exe	privacy.exe
PID 704 wrote to memory of 844	704	2c8406cceb353bae116d283f3aea53862bdad900f49bd33583cdab6df036c99d.exe	privacy.exe
PID 704 wrote to memory of 844	704	2c8406cceb353bae116d283f3aea53862bdad900f49bd33583cdab6df036c99d.exe	privacy.exe

C:\Users\Admin\AppData\Local\Temp\2c8406cceb353bae116d283f3aea53862bdad900f49bd33583cdab6df036c99d.exe
"C:\Users\Admin\AppData\Local\Temp\2c8406cceb353bae116d283f3aea53862bdad900f49bd33583cdab6df036c99d.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:704

C:\ProgramData\privacy.exe
C:\ProgramData\privacy.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:844

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\privacy.exe
Filesize
802KB

MD5
3ca47fc665b4b9e26e48262135ad77d1

SHA1
3ee223f553fbbb538c859ba8e9adc71a311fff82

SHA256
50dcdb185106b601a4f746fa96d4d27b24aee24df66189972ce20a7269fe6b89

SHA512
25c4937b22285a58df915040d9f305ae3a35f1972f8e6fc4eb81af42b8a4a4aa5305e74705cda085054b284dd7c798a52c5868aad2918e17170cc9de89d845f6

Download Submit
\ProgramData\privacy.exe
Filesize
802KB

MD5
3ca47fc665b4b9e26e48262135ad77d1

SHA1
3ee223f553fbbb538c859ba8e9adc71a311fff82

SHA256
50dcdb185106b601a4f746fa96d4d27b24aee24df66189972ce20a7269fe6b89

SHA512
25c4937b22285a58df915040d9f305ae3a35f1972f8e6fc4eb81af42b8a4a4aa5305e74705cda085054b284dd7c798a52c5868aad2918e17170cc9de89d845f6

Download Submit
\ProgramData\privacy.exe
Filesize
802KB

MD5
3ca47fc665b4b9e26e48262135ad77d1

SHA1
3ee223f553fbbb538c859ba8e9adc71a311fff82

SHA256
50dcdb185106b601a4f746fa96d4d27b24aee24df66189972ce20a7269fe6b89

SHA512
25c4937b22285a58df915040d9f305ae3a35f1972f8e6fc4eb81af42b8a4a4aa5305e74705cda085054b284dd7c798a52c5868aad2918e17170cc9de89d845f6

Download Submit
\ProgramData\privacy.exe
Filesize
802KB

MD5
3ca47fc665b4b9e26e48262135ad77d1

SHA1
3ee223f553fbbb538c859ba8e9adc71a311fff82

SHA256
50dcdb185106b601a4f746fa96d4d27b24aee24df66189972ce20a7269fe6b89

SHA512
25c4937b22285a58df915040d9f305ae3a35f1972f8e6fc4eb81af42b8a4a4aa5305e74705cda085054b284dd7c798a52c5868aad2918e17170cc9de89d845f6

Download Submit
memory/704-54-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

Filesize
8KB

Download
memory/704-55-0x0000000000400000-0x00000000005B5000-memory.dmp

Filesize
1.7MB

Download
memory/704-56-0x0000000002010000-0x0000000002016000-memory.dmp

Filesize
24KB

Download
memory/844-60-0x0000000000000000-mapping.dmp

Download
memory/844-63-0x0000000000BB0000-0x0000000000BB7000-memory.dmp

Filesize
28KB

Download
memory/844-64-0x0000000000400000-0x0000000000AF0000-memory.dmp

Filesize
6.9MB

Download
memory/844-66-0x0000000000400000-0x0000000000AF0000-memory.dmp

Filesize
6.9MB

Download
memory/844-67-0x0000000000400000-0x0000000000AF0000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads