b3a547930699d31d925ae64328d29f60cba04f3f2b8877e5df48429c6b72c812

General

Target

b3a547930699d31d925ae64328d29f60cba04f3f2b8877e5df48429c6b72c812.exe
Size

231KB
MD5

66df086ce2015d48d6de9b2379553c5d
SHA1

c23b8a22f109059ab700af091e668e26a656d241
SHA256

b3a547930699d31d925ae64328d29f60cba04f3f2b8877e5df48429c6b72c812
SHA512

44237446c4ed26fe7510b571aeab9f0d3610ec34876927cf383a5f16f62103c94e816b8716af6223ea093de49814578be7b78831f044b7a7b61ef0c4deae0ad8
SSDEEP

3072:WaljkuxzrQMV46d/u48NOusseWopayA7j3iPFRjW5wIEcYu:WtuBp46pu46Grpan3iPFs5wIf

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1992	ctfnom.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000900000001232e-58.dat	upx
behavioral1/files/0x000900000001232e-59.dat	upx
behavioral1/files/0x000900000001232e-61.dat	upx
behavioral1/memory/2044-64-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/1992-66-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x000900000001232e-68.dat	upx
behavioral1/memory/2044-70-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/1992-73-0x0000000000400000-0x000000000043B000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
2044	b3a547930699d31d925ae64328d29f60cba04f3f2b8877e5df48429c6b72c812.exe
2044	b3a547930699d31d925ae64328d29f60cba04f3f2b8877e5df48429c6b72c812.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\windows\CurrentVersion\Run	ctfnom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ctfnom = "C:\\Users\\Admin\\AppData\\Roaming\\Dir\\ctfnom.exe"	ctfnom.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2044	b3a547930699d31d925ae64328d29f60cba04f3f2b8877e5df48429c6b72c812.exe
1992	ctfnom.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2044	b3a547930699d31d925ae64328d29f60cba04f3f2b8877e5df48429c6b72c812.exe
2044	b3a547930699d31d925ae64328d29f60cba04f3f2b8877e5df48429c6b72c812.exe
1992	ctfnom.exe
1992	ctfnom.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2024	2044	b3a547930699d31d925ae64328d29f60cba04f3f2b8877e5df48429c6b72c812.exe	28
PID 2044 wrote to memory of 2024	2044	b3a547930699d31d925ae64328d29f60cba04f3f2b8877e5df48429c6b72c812.exe	28
PID 2044 wrote to memory of 2024	2044	b3a547930699d31d925ae64328d29f60cba04f3f2b8877e5df48429c6b72c812.exe	28
PID 2044 wrote to memory of 2024	2044	b3a547930699d31d925ae64328d29f60cba04f3f2b8877e5df48429c6b72c812.exe	28
PID 2044 wrote to memory of 1992	2044	b3a547930699d31d925ae64328d29f60cba04f3f2b8877e5df48429c6b72c812.exe	30
PID 2044 wrote to memory of 1992	2044	b3a547930699d31d925ae64328d29f60cba04f3f2b8877e5df48429c6b72c812.exe	30
PID 2044 wrote to memory of 1992	2044	b3a547930699d31d925ae64328d29f60cba04f3f2b8877e5df48429c6b72c812.exe	30
PID 2044 wrote to memory of 1992	2044	b3a547930699d31d925ae64328d29f60cba04f3f2b8877e5df48429c6b72c812.exe	30
PID 1992 wrote to memory of 472	1992	ctfnom.exe	31
PID 1992 wrote to memory of 472	1992	ctfnom.exe	31
PID 1992 wrote to memory of 472	1992	ctfnom.exe	31
PID 1992 wrote to memory of 472	1992	ctfnom.exe	31
PID 472 wrote to memory of 1292	472	net.exe	34
PID 472 wrote to memory of 1292	472	net.exe	34
PID 472 wrote to memory of 1292	472	net.exe	34
PID 472 wrote to memory of 1292	472	net.exe	34
PID 2024 wrote to memory of 440	2024	net.exe	33
PID 2024 wrote to memory of 440	2024	net.exe	33
PID 2024 wrote to memory of 440	2024	net.exe	33
PID 2024 wrote to memory of 440	2024	net.exe	33

C:\Users\Admin\AppData\Local\Temp\b3a547930699d31d925ae64328d29f60cba04f3f2b8877e5df48429c6b72c812.exe
"C:\Users\Admin\AppData\Local\Temp\b3a547930699d31d925ae64328d29f60cba04f3f2b8877e5df48429c6b72c812.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop sharedaccess
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop sharedaccess
    3⤵
    PID:440
- C:\Users\Admin\AppData\Roaming\Dir\ctfnom.exe
  C:\Users\Admin\AppData\Roaming\Dir\ctfnom.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop sharedaccess
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:472
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      PID:1292

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Dir\ctfnom.exe

Filesize
231KB

MD5
66df086ce2015d48d6de9b2379553c5d

SHA1
c23b8a22f109059ab700af091e668e26a656d241

SHA256
b3a547930699d31d925ae64328d29f60cba04f3f2b8877e5df48429c6b72c812

SHA512
44237446c4ed26fe7510b571aeab9f0d3610ec34876927cf383a5f16f62103c94e816b8716af6223ea093de49814578be7b78831f044b7a7b61ef0c4deae0ad8

Download Submit
C:\Users\Admin\AppData\Roaming\Dir\ctfnom.exe

Filesize
231KB

MD5
66df086ce2015d48d6de9b2379553c5d

SHA1
c23b8a22f109059ab700af091e668e26a656d241

SHA256
b3a547930699d31d925ae64328d29f60cba04f3f2b8877e5df48429c6b72c812

SHA512
44237446c4ed26fe7510b571aeab9f0d3610ec34876927cf383a5f16f62103c94e816b8716af6223ea093de49814578be7b78831f044b7a7b61ef0c4deae0ad8

Download Submit
\Users\Admin\AppData\Roaming\Dir\ctfnom.exe

Filesize
231KB

MD5
66df086ce2015d48d6de9b2379553c5d

SHA1
c23b8a22f109059ab700af091e668e26a656d241

SHA256
b3a547930699d31d925ae64328d29f60cba04f3f2b8877e5df48429c6b72c812

SHA512
44237446c4ed26fe7510b571aeab9f0d3610ec34876927cf383a5f16f62103c94e816b8716af6223ea093de49814578be7b78831f044b7a7b61ef0c4deae0ad8

Download Submit
\Users\Admin\AppData\Roaming\Dir\ctfnom.exe

Filesize
231KB

MD5
66df086ce2015d48d6de9b2379553c5d

SHA1
c23b8a22f109059ab700af091e668e26a656d241

SHA256
b3a547930699d31d925ae64328d29f60cba04f3f2b8877e5df48429c6b72c812

SHA512
44237446c4ed26fe7510b571aeab9f0d3610ec34876927cf383a5f16f62103c94e816b8716af6223ea093de49814578be7b78831f044b7a7b61ef0c4deae0ad8

Download Submit
memory/1992-66-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1992-73-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2044-56-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/2044-64-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2044-65-0x0000000003E60000-0x0000000003E9B000-memory.dmp

Filesize
236KB

Download
memory/2044-70-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download

Analysis

Sharing