a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485

General

Target

a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
Size

22KB
MD5

2af5065c10355f8c2558aa60cf529042
SHA1

a2a5a1d18cbfb6834b94adaeb3ead77c109caa17
SHA256

a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485
SHA512

d473d1eac124ae7bc8bd6640ee1e1cc5bf0c18439dd0b2c924ba658d228a5c7d12fd8c2d2610edd9ebb2c07a314d78aa20c41b5396ecada22bf26e0e175fdae8
SSDEEP

384:Piv9NM67LuJP7xaQ0xh5K+BrIyucYetD++xh1iyzknYjc5SamYhNcngkB:P0fMrL0xhNBBYetDxhY1Yjcw3vngW

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe

Deletes itself 1 IoCs

pid	Process
684	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
916	taskkill.exe

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IE\shell\open\command\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE "	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IE\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE,0"	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IE\ = "????"	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IE\NeverShowExt = "1"	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IE\shell\open	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IE\shell\open\command	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IE\DefaultIcon	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.IE	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.IE\ = "IE"	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IE	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IE\shell	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1604	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1000	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1000	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
Token: SeDebugPrivilege	916	taskkill.exe
Token: SeDebugPrivilege	1000	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
Token: SeDebugPrivilege	1000	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
Token: SeDebugPrivilege	1000	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
Token: SeDebugPrivilege	1000	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1000	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 916	1000	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe	27
PID 1000 wrote to memory of 916	1000	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe	27
PID 1000 wrote to memory of 916	1000	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe	27
PID 1000 wrote to memory of 916	1000	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe	27
PID 1000 wrote to memory of 684	1000	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe	30
PID 1000 wrote to memory of 684	1000	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe	30
PID 1000 wrote to memory of 684	1000	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe	30
PID 1000 wrote to memory of 684	1000	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe	30
PID 684 wrote to memory of 1604	684	cmd.exe	33
PID 684 wrote to memory of 1604	684	cmd.exe	33
PID 684 wrote to memory of 1604	684	cmd.exe	33
PID 684 wrote to memory of 1604	684	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
"C:\Users\Admin\AppData\Local\Temp\a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im ZhuDongFangyu.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:916
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 1 && del "C:\Users\Admin\AppData\Local\Temp\a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:684
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 1
    3⤵
    - Runs ping.exe
    PID:1604

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1000-57-0x0000000076561000-0x0000000076563000-memory.dmp

Filesize
8KB

Download
memory/1000-59-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads