d13a21f28f5008e2ff4ff40776b7e2a10196b6986c28c4ed1bea1a047987e053

General

Target

d13a21f28f5008e2ff4ff40776b7e2a10196b6986c28c4ed1bea1a047987e053.exe
Size

118KB
MD5

46e640cea40217f1b8cd582184c798b3
SHA1

728bb6be9a60b3d773ee1ac01e68c3454d386c68
SHA256

d13a21f28f5008e2ff4ff40776b7e2a10196b6986c28c4ed1bea1a047987e053
SHA512

b5d23f6c6b266eec425e749efcfedaaa544397ede2ba32d0bcc1691eb30efcd684fe476167150b22524d5c9a16feaf7a15107667155024e03eddc6b273121e9c
SSDEEP

1536:BiwR7wjJltueHk5Z6BnZIpDkYeL0tALm/3C2hktkJxUe+9/nwodoYUoyJKrFVfo:39eJlMv5UypnGyALN+xU9ntnUoyefo

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\showsuperhidden = "0"	d13a21f28f5008e2ff4ff40776b7e2a10196b6986c28c4ed1bea1a047987e053.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\showsuperhidden = "0"	msnmsgr.exe

Executes dropped EXE 2 IoCs

pid	Process
4040	msnmsgr.exe
4940	msnmsgr.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	d13a21f28f5008e2ff4ff40776b7e2a10196b6986c28c4ed1bea1a047987e053.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	msnmsgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe Flash Accelerator = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\System Root Certificates\\msnmsgr.exe"	msnmsgr.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	msnmsgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe Flash Accelerator = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\System Root Certificates\\msnmsgr.exe"	msnmsgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	d13a21f28f5008e2ff4ff40776b7e2a10196b6986c28c4ed1bea1a047987e053.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe Flash Accelerator = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\System Root Certificates\\msnmsgr.exe"	d13a21f28f5008e2ff4ff40776b7e2a10196b6986c28c4ed1bea1a047987e053.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	d13a21f28f5008e2ff4ff40776b7e2a10196b6986c28c4ed1bea1a047987e053.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe Flash Accelerator = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\System Root Certificates\\msnmsgr.exe"	d13a21f28f5008e2ff4ff40776b7e2a10196b6986c28c4ed1bea1a047987e053.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 516 set thread context of 4652	516	d13a21f28f5008e2ff4ff40776b7e2a10196b6986c28c4ed1bea1a047987e053.exe	81
PID 4040 set thread context of 4940	4040	msnmsgr.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\lnkfile	d13a21f28f5008e2ff4ff40776b7e2a10196b6986c28c4ed1bea1a047987e053.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	d13a21f28f5008e2ff4ff40776b7e2a10196b6986c28c4ed1bea1a047987e053.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\lnkfile	msnmsgr.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 516 wrote to memory of 4652	516	d13a21f28f5008e2ff4ff40776b7e2a10196b6986c28c4ed1bea1a047987e053.exe	81
PID 516 wrote to memory of 4652	516	d13a21f28f5008e2ff4ff40776b7e2a10196b6986c28c4ed1bea1a047987e053.exe	81
PID 516 wrote to memory of 4652	516	d13a21f28f5008e2ff4ff40776b7e2a10196b6986c28c4ed1bea1a047987e053.exe	81
PID 516 wrote to memory of 4652	516	d13a21f28f5008e2ff4ff40776b7e2a10196b6986c28c4ed1bea1a047987e053.exe	81
PID 516 wrote to memory of 4652	516	d13a21f28f5008e2ff4ff40776b7e2a10196b6986c28c4ed1bea1a047987e053.exe	81
PID 516 wrote to memory of 4652	516	d13a21f28f5008e2ff4ff40776b7e2a10196b6986c28c4ed1bea1a047987e053.exe	81
PID 516 wrote to memory of 4652	516	d13a21f28f5008e2ff4ff40776b7e2a10196b6986c28c4ed1bea1a047987e053.exe	81
PID 516 wrote to memory of 4652	516	d13a21f28f5008e2ff4ff40776b7e2a10196b6986c28c4ed1bea1a047987e053.exe	81
PID 4652 wrote to memory of 4040	4652	d13a21f28f5008e2ff4ff40776b7e2a10196b6986c28c4ed1bea1a047987e053.exe	88
PID 4652 wrote to memory of 4040	4652	d13a21f28f5008e2ff4ff40776b7e2a10196b6986c28c4ed1bea1a047987e053.exe	88
PID 4652 wrote to memory of 4040	4652	d13a21f28f5008e2ff4ff40776b7e2a10196b6986c28c4ed1bea1a047987e053.exe	88
PID 4040 wrote to memory of 4940	4040	msnmsgr.exe	90
PID 4040 wrote to memory of 4940	4040	msnmsgr.exe	90
PID 4040 wrote to memory of 4940	4040	msnmsgr.exe	90
PID 4040 wrote to memory of 4940	4040	msnmsgr.exe	90
PID 4040 wrote to memory of 4940	4040	msnmsgr.exe	90
PID 4040 wrote to memory of 4940	4040	msnmsgr.exe	90
PID 4040 wrote to memory of 4940	4040	msnmsgr.exe	90
PID 4040 wrote to memory of 4940	4040	msnmsgr.exe	90

C:\Users\Admin\AppData\Local\Temp\d13a21f28f5008e2ff4ff40776b7e2a10196b6986c28c4ed1bea1a047987e053.exe
"C:\Users\Admin\AppData\Local\Temp\d13a21f28f5008e2ff4ff40776b7e2a10196b6986c28c4ed1bea1a047987e053.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:516
- C:\Users\Admin\AppData\Local\Temp\d13a21f28f5008e2ff4ff40776b7e2a10196b6986c28c4ed1bea1a047987e053.exe
  C:\Users\Admin\AppData\Local\Temp\d13a21f28f5008e2ff4ff40776b7e2a10196b6986c28c4ed1bea1a047987e053.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Checks computer location settings
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Users\Admin\AppData\Roaming\Microsoft\System Root Certificates\msnmsgr.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\System Root Certificates\msnmsgr.exe" ybu
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4040
  - - C:\Users\Admin\AppData\Roaming\Microsoft\System Root Certificates\msnmsgr.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\System Root Certificates\msnmsgr.exe"
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Modifies registry class
      PID:4940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\System Root Certificates\msnmsgr.exe

Filesize
118KB

MD5
46e640cea40217f1b8cd582184c798b3

SHA1
728bb6be9a60b3d773ee1ac01e68c3454d386c68

SHA256
d13a21f28f5008e2ff4ff40776b7e2a10196b6986c28c4ed1bea1a047987e053

SHA512
b5d23f6c6b266eec425e749efcfedaaa544397ede2ba32d0bcc1691eb30efcd684fe476167150b22524d5c9a16feaf7a15107667155024e03eddc6b273121e9c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\System Root Certificates\msnmsgr.exe

Filesize
118KB

MD5
46e640cea40217f1b8cd582184c798b3

SHA1
728bb6be9a60b3d773ee1ac01e68c3454d386c68

SHA256
d13a21f28f5008e2ff4ff40776b7e2a10196b6986c28c4ed1bea1a047987e053

SHA512
b5d23f6c6b266eec425e749efcfedaaa544397ede2ba32d0bcc1691eb30efcd684fe476167150b22524d5c9a16feaf7a15107667155024e03eddc6b273121e9c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\System Root Certificates\msnmsgr.exe

Filesize
118KB

MD5
46e640cea40217f1b8cd582184c798b3

SHA1
728bb6be9a60b3d773ee1ac01e68c3454d386c68

SHA256
d13a21f28f5008e2ff4ff40776b7e2a10196b6986c28c4ed1bea1a047987e053

SHA512
b5d23f6c6b266eec425e749efcfedaaa544397ede2ba32d0bcc1691eb30efcd684fe476167150b22524d5c9a16feaf7a15107667155024e03eddc6b273121e9c

Download Submit
memory/4040-137-0x0000000000000000-mapping.dmp

Download
memory/4652-132-0x0000000000000000-mapping.dmp

Download
memory/4652-133-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/4652-135-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/4652-136-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/4940-140-0x0000000000000000-mapping.dmp

Download
memory/4940-145-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads