3a5ad49679efa697828aefd5bdb396739767445a9c8ae8e109766fbbde916ed6

General

Target

3a5ad49679efa697828aefd5bdb396739767445a9c8ae8e109766fbbde916ed6.exe
Size

129KB
MD5

0a0df2cad0ff7cc3a7879654d6b3c06c
SHA1

48dd2b67b514cb3b8b51e1c13d437d1a39cfce17
SHA256

3a5ad49679efa697828aefd5bdb396739767445a9c8ae8e109766fbbde916ed6
SHA512

f4bd68dfedfcf5dbe9db97c009c07f86bf11faa8a8631d7c9d873c5ac43852b1ee196a7e5f4eb08db331f9a7e72acdad64399e866206824392a8560e53a38cb1
SSDEEP

1536:8ET7XqHWQVeC6wRikLcWj9ycokOqR/+bZm9CqzxqVtK0phTI03lOOoJkfRuCkEEx:v7Xq2QVeCH9Bxozhzi0VcJkfR5E3a2t

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1496	iservices.exe
1320	ineexplorer.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1736-58-0x0000000000400000-0x0000000000437000-memory.dmp	upx
behavioral1/memory/1736-68-0x0000000000400000-0x0000000000437000-memory.dmp	upx

Loads dropped DLL 4 IoCs

pid	Process
1736	3a5ad49679efa697828aefd5bdb396739767445a9c8ae8e109766fbbde916ed6.exe
1736	3a5ad49679efa697828aefd5bdb396739767445a9c8ae8e109766fbbde916ed6.exe
1736	3a5ad49679efa697828aefd5bdb396739767445a9c8ae8e109766fbbde916ed6.exe
1736	3a5ad49679efa697828aefd5bdb396739767445a9c8ae8e109766fbbde916ed6.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\SysWOW64\\iservices.exe"	iservices.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	ineexplorer.exe
File opened (read-only)	\??\W:	ineexplorer.exe
File opened (read-only)	\??\E:	ineexplorer.exe
File opened (read-only)	\??\J:	ineexplorer.exe
File opened (read-only)	\??\L:	ineexplorer.exe
File opened (read-only)	\??\M:	ineexplorer.exe
File opened (read-only)	\??\P:	ineexplorer.exe
File opened (read-only)	\??\R:	ineexplorer.exe
File opened (read-only)	\??\V:	ineexplorer.exe
File opened (read-only)	\??\Z:	ineexplorer.exe
File opened (read-only)	\??\B:	ineexplorer.exe
File opened (read-only)	\??\G:	ineexplorer.exe
File opened (read-only)	\??\I:	ineexplorer.exe
File opened (read-only)	\??\X:	ineexplorer.exe
File opened (read-only)	\??\Y:	ineexplorer.exe
File opened (read-only)	\??\N:	ineexplorer.exe
File opened (read-only)	\??\Q:	ineexplorer.exe
File opened (read-only)	\??\S:	ineexplorer.exe
File opened (read-only)	\??\K:	ineexplorer.exe
File opened (read-only)	\??\T:	ineexplorer.exe
File opened (read-only)	\??\U:	ineexplorer.exe
File opened (read-only)	\??\A:	ineexplorer.exe
File opened (read-only)	\??\F:	ineexplorer.exe
File opened (read-only)	\??\H:	ineexplorer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\iservices.exe	3a5ad49679efa697828aefd5bdb396739767445a9c8ae8e109766fbbde916ed6.exe
File opened for modification	C:\Windows\SysWOW64\ineexplorer.exe	3a5ad49679efa697828aefd5bdb396739767445a9c8ae8e109766fbbde916ed6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1736	3a5ad49679efa697828aefd5bdb396739767445a9c8ae8e109766fbbde916ed6.exe
1496	iservices.exe
1320	ineexplorer.exe
1496	iservices.exe
1320	ineexplorer.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1496	1736	3a5ad49679efa697828aefd5bdb396739767445a9c8ae8e109766fbbde916ed6.exe	28
PID 1736 wrote to memory of 1496	1736	3a5ad49679efa697828aefd5bdb396739767445a9c8ae8e109766fbbde916ed6.exe	28
PID 1736 wrote to memory of 1496	1736	3a5ad49679efa697828aefd5bdb396739767445a9c8ae8e109766fbbde916ed6.exe	28
PID 1736 wrote to memory of 1496	1736	3a5ad49679efa697828aefd5bdb396739767445a9c8ae8e109766fbbde916ed6.exe	28
PID 1736 wrote to memory of 1320	1736	3a5ad49679efa697828aefd5bdb396739767445a9c8ae8e109766fbbde916ed6.exe	29
PID 1736 wrote to memory of 1320	1736	3a5ad49679efa697828aefd5bdb396739767445a9c8ae8e109766fbbde916ed6.exe	29
PID 1736 wrote to memory of 1320	1736	3a5ad49679efa697828aefd5bdb396739767445a9c8ae8e109766fbbde916ed6.exe	29
PID 1736 wrote to memory of 1320	1736	3a5ad49679efa697828aefd5bdb396739767445a9c8ae8e109766fbbde916ed6.exe	29

C:\Users\Admin\AppData\Local\Temp\3a5ad49679efa697828aefd5bdb396739767445a9c8ae8e109766fbbde916ed6.exe
"C:\Users\Admin\AppData\Local\Temp\3a5ad49679efa697828aefd5bdb396739767445a9c8ae8e109766fbbde916ed6.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\iservices.exe
  "C:\Windows\system32\iservices.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetWindowsHookEx
  PID:1496
- C:\Windows\SysWOW64\ineexplorer.exe
  "C:\Windows\system32\ineexplorer.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:1320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ineexplorer.exe

Filesize
98KB

MD5
1773038a247bb236e3996c5acea0391b

SHA1
009cd89788310208ba168872dc4ca0b5087aac5c

SHA256
6be3dd8f40408c82bedfe0c15ba476122b0f24b4130d17d6eabdad7df21c329a

SHA512
2e89ef5f744eba924b5569adcf8121581eaeb888f7711748b7b5f42373fd9ddf334f599dfd8384fcc66e78b34c0eb1e7c583e67636389e79474eb5c50a0b81a3

Download Submit
C:\Windows\SysWOW64\iservices.exe

Filesize
88KB

MD5
785ad1ab944591eef94937e82b5a05f8

SHA1
6ce76389df7791d33c1a6dfd2d8b5f5d668a125e

SHA256
0fcf6c7314eb46ff497d4b4260b8f67993c978591df4a9aab80cf568382e30d4

SHA512
fecddc6c2356dfc91dd89db3829ffa12e982a0531d4685598e5ce40f260e50e372e841ecc496e027cf70e85acd23500f10c33a35e01dafec51353384b73865bc

Download Submit
\Windows\SysWOW64\ineexplorer.exe

Filesize
98KB

MD5
1773038a247bb236e3996c5acea0391b

SHA1
009cd89788310208ba168872dc4ca0b5087aac5c

SHA256
6be3dd8f40408c82bedfe0c15ba476122b0f24b4130d17d6eabdad7df21c329a

SHA512
2e89ef5f744eba924b5569adcf8121581eaeb888f7711748b7b5f42373fd9ddf334f599dfd8384fcc66e78b34c0eb1e7c583e67636389e79474eb5c50a0b81a3

Download Submit
\Windows\SysWOW64\ineexplorer.exe

Filesize
98KB

MD5
1773038a247bb236e3996c5acea0391b

SHA1
009cd89788310208ba168872dc4ca0b5087aac5c

SHA256
6be3dd8f40408c82bedfe0c15ba476122b0f24b4130d17d6eabdad7df21c329a

SHA512
2e89ef5f744eba924b5569adcf8121581eaeb888f7711748b7b5f42373fd9ddf334f599dfd8384fcc66e78b34c0eb1e7c583e67636389e79474eb5c50a0b81a3

Download Submit
\Windows\SysWOW64\iservices.exe

Filesize
88KB

MD5
785ad1ab944591eef94937e82b5a05f8

SHA1
6ce76389df7791d33c1a6dfd2d8b5f5d668a125e

SHA256
0fcf6c7314eb46ff497d4b4260b8f67993c978591df4a9aab80cf568382e30d4

SHA512
fecddc6c2356dfc91dd89db3829ffa12e982a0531d4685598e5ce40f260e50e372e841ecc496e027cf70e85acd23500f10c33a35e01dafec51353384b73865bc

Download Submit
\Windows\SysWOW64\iservices.exe

Filesize
88KB

MD5
785ad1ab944591eef94937e82b5a05f8

SHA1
6ce76389df7791d33c1a6dfd2d8b5f5d668a125e

SHA256
0fcf6c7314eb46ff497d4b4260b8f67993c978591df4a9aab80cf568382e30d4

SHA512
fecddc6c2356dfc91dd89db3829ffa12e982a0531d4685598e5ce40f260e50e372e841ecc496e027cf70e85acd23500f10c33a35e01dafec51353384b73865bc

Download Submit
memory/1736-56-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/1736-58-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1736-68-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download

Analysis

Sharing