e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052

General

Target

e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe
Size

128KB
MD5

00f46c4b31c5eb5a695963348faf84cc
SHA1

8b60b17873f0bd0a3ba0174877bbd5d33069005f
SHA256

e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052
SHA512

aa45c08e2e783efb8be8c4a0df4ea0c8a8898df20df4df667b003ee7d700682a4521c5bf3c5a91735efa6d98b5afddff9f86b8760d66b4033d5651fa35c07770
SSDEEP

1536:GQV6ZVHYt11f3F+p4f3T4Bonhn/CrrrlX8+wfyYc3QuF/H3gytusDQv3gyOKqHZz:GQsZVHYt11fRkbYGQuFvV2WPKIFiMGc

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Internet Explorer.lnk	e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\windv32_twqa = "C:\\Program Files\\Winvows Publwqa\\services.exe"	regedit.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\2.txt	e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe
File created	C:\Windows\SysWOW64\1.txt	e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe
File opened for modification	C:\Windows\SysWOW64\1.txt	e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe
File opened for modification	C:\Windows\SysWOW64\internat.exe.txt	e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe
File opened for modification	C:\Windows\SysWOW64\internat.exe	e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Winvows Publwqa\services.exe.txt	e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe
File opened for modification	C:\Program Files\Winvows Publwqa\services.exe	e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\Winvows Publwqa\services.exe.txt	e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe
File opened for modification	C:\WINDOWS\Winvows Publwqa\services.exe	e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs .reg file with regedit 1 IoCs

pid	Process
4832	regedit.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5044	e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe
5044	e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe
5044	e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe
5044	e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe
5044	e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe
5044	e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5044	e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5044	e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5044	e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe
5044	e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe
5044	e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe
4208	e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe
4208	e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe
4208	e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 4208	5044	e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe	81
PID 5044 wrote to memory of 4208	5044	e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe	81
PID 5044 wrote to memory of 4208	5044	e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe	81
PID 5044 wrote to memory of 4832	5044	e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe	83
PID 5044 wrote to memory of 4832	5044	e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe	83
PID 5044 wrote to memory of 4832	5044	e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe	83

C:\Users\Admin\AppData\Local\Temp\e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe
"C:\Users\Admin\AppData\Local\Temp\e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe"
1⤵
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Users\Admin\AppData\Local\Temp\e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe
  C:\Users\Admin\AppData\Local\Temp\e7776efb33f80d0d1bc7c4c375767ee99d57aa688237f6d681e202849b107052.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4208
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\1.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:4832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\1.reg

Filesize
173B

MD5
643595e540e88c8a8292a1efe1ec53fe

SHA1
3afe9e981b1482fbab77daa33b0d9c921c4d5342

SHA256
3e65611dd4616828f7143f9e5e072b81c284d4f72c02461d8615674f2d4ba571

SHA512
1610689a7da943eb19d4b16070c048ab6267bb6fd459723c88cf7881fb89387e58840ee15960db4688e0e81d871e1f51516714b8969ef73faa4ff6b6666510d7

Download Submit

Analysis

Sharing