f2acfb304c1a01d708a90d1c7a707562b80379d0f189e39c786ada78ccebbd7b

General

Target

f2acfb304c1a01d708a90d1c7a707562b80379d0f189e39c786ada78ccebbd7b.exe
Size

1.6MB
MD5

642350a939ff8aa8ecea090f8221ac20
SHA1

b4c893ad3ddf50ebd8d98f3c53e615d946fc866f
SHA256

f2acfb304c1a01d708a90d1c7a707562b80379d0f189e39c786ada78ccebbd7b
SHA512

f548cd2ff623106797b655964dd105bd06e464eea9a59bd388245d4b743176012e1dcd0e3df9f7ed9759c5a6d8fadc736815539156544331a972d7da9b4d645e
SSDEEP

24576:udZe+jWVZNqWDS/bgpunWA+75j69cuHst5aKf+PuG8IIi4hZphbyc:uH+PoWDUgzhu9cuMt4vTaiqZe

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

ServerMinecraft.exe

pid process

4216 ServerMinecraft.exe

pid	process
4216	ServerMinecraft.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f2acfb304c1a01d708a90d1c7a707562b80379d0f189e39c786ada78ccebbd7b.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	f2acfb304c1a01d708a90d1c7a707562b80379d0f189e39c786ada78ccebbd7b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dw20.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

dw20.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Modifies registry class 1 IoCs

Processes:

f2acfb304c1a01d708a90d1c7a707562b80379d0f189e39c786ada78ccebbd7b.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	f2acfb304c1a01d708a90d1c7a707562b80379d0f189e39c786ada78ccebbd7b.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid process

620 vlc.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

vlc.exe

pid process

620 vlc.exe

pid	process
620	vlc.exe

pid	process
620	vlc.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

dw20.exeAUDIODG.EXEvlc.exe

description	pid	process
Token: SeRestorePrivilege	1180	dw20.exe
Token: SeBackupPrivilege	1180	dw20.exe
Token: SeBackupPrivilege	1180	dw20.exe
Token: SeBackupPrivilege	1180	dw20.exe
Token: 33	176	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	176	AUDIODG.EXE
Token: 33	620	vlc.exe
Token: SeIncBasePriorityPrivilege	620	vlc.exe

Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

vlc.exe

pid process

620 vlc.exe
620 vlc.exe
620 vlc.exe
620 vlc.exe
620 vlc.exe
620 vlc.exe
620 vlc.exe
620 vlc.exe
Suspicious use of SendNotifyMessage 7 IoCs

Processes:

vlc.exe

pid process

620 vlc.exe
620 vlc.exe
620 vlc.exe
620 vlc.exe
620 vlc.exe
620 vlc.exe
620 vlc.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vlc.exe

pid process

620 vlc.exe

pid	process
620	vlc.exe
620	vlc.exe
620	vlc.exe
620	vlc.exe
620	vlc.exe
620	vlc.exe
620	vlc.exe
620	vlc.exe

pid	process
620	vlc.exe
620	vlc.exe
620	vlc.exe
620	vlc.exe
620	vlc.exe
620	vlc.exe
620	vlc.exe

pid	process
620	vlc.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

f2acfb304c1a01d708a90d1c7a707562b80379d0f189e39c786ada78ccebbd7b.exeServerMinecraft.exe

description	pid	process	target process
PID 2320 wrote to memory of 4216	2320	f2acfb304c1a01d708a90d1c7a707562b80379d0f189e39c786ada78ccebbd7b.exe	ServerMinecraft.exe
PID 2320 wrote to memory of 4216	2320	f2acfb304c1a01d708a90d1c7a707562b80379d0f189e39c786ada78ccebbd7b.exe	ServerMinecraft.exe
PID 2320 wrote to memory of 4216	2320	f2acfb304c1a01d708a90d1c7a707562b80379d0f189e39c786ada78ccebbd7b.exe	ServerMinecraft.exe
PID 2320 wrote to memory of 620	2320	f2acfb304c1a01d708a90d1c7a707562b80379d0f189e39c786ada78ccebbd7b.exe	vlc.exe
PID 2320 wrote to memory of 620	2320	f2acfb304c1a01d708a90d1c7a707562b80379d0f189e39c786ada78ccebbd7b.exe	vlc.exe
PID 4216 wrote to memory of 1180	4216	ServerMinecraft.exe	dw20.exe
PID 4216 wrote to memory of 1180	4216	ServerMinecraft.exe	dw20.exe
PID 4216 wrote to memory of 1180	4216	ServerMinecraft.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\f2acfb304c1a01d708a90d1c7a707562b80379d0f189e39c786ada78ccebbd7b.exe
"C:\Users\Admin\AppData\Local\Temp\f2acfb304c1a01d708a90d1c7a707562b80379d0f189e39c786ada78ccebbd7b.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2320

C:\Users\Admin\AppData\Local\Temp\ServerMinecraft.exe
"C:\Users\Admin\AppData\Local\Temp\ServerMinecraft.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 796
3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:1180

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\ÊæÒíä.mp3"
2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:620

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x398 0x4a0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:176

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ServerMinecraft.exe
Filesize
49KB

MD5
0778cbc7e472f450c2bf8855719b5ca4

SHA1
dbc48c862eb6dfddc9007d246a64c1e11b063969

SHA256
28cd0ae4cfe7a50d75e5e866d36a4c174065407f24e23c7c631bc130f80b288d

SHA512
c964b46d8a033eed5dc85a6e6f55f51c7e07088121b0bd4ab69a3b83593473e528c3aef8286b8b7f5add14435c307d92fdd08d2c09188541132aa6f57d70873d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ServerMinecraft.exe
Filesize
49KB

MD5
0778cbc7e472f450c2bf8855719b5ca4

SHA1
dbc48c862eb6dfddc9007d246a64c1e11b063969

SHA256
28cd0ae4cfe7a50d75e5e866d36a4c174065407f24e23c7c631bc130f80b288d

SHA512
c964b46d8a033eed5dc85a6e6f55f51c7e07088121b0bd4ab69a3b83593473e528c3aef8286b8b7f5add14435c307d92fdd08d2c09188541132aa6f57d70873d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ÊæÒíä.mp3
Filesize
1.4MB

MD5
89b73a34ea5634807f5b7c36e9ed3755

SHA1
01a12b8ca66adb5000a1dc3f23e64fe521a5f154

SHA256
76e673f5161952de32688c1bd59c0ec2cc84475d8cc790c38be1056057e09a77

SHA512
ce0ed525b2c6b454ac8477c6c963532f97434bf29881f136312106b4631fa331e3142bfbfe62d8cba63b8cdcd886d617391fe89ceb8df84cf9aec3056c1cd3d4

Download Submit
memory/620-135-0x0000000000000000-mapping.dmp

Download
memory/1180-137-0x0000000000000000-mapping.dmp

Download
memory/4216-132-0x0000000000000000-mapping.dmp

Download
memory/4216-136-0x0000000073D40000-0x00000000742F1000-memory.dmp

Filesize
5.7MB

Download
memory/4216-139-0x0000000073D40000-0x00000000742F1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads