a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485

General

Target

a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
Size

22KB
MD5

2af5065c10355f8c2558aa60cf529042
SHA1

a2a5a1d18cbfb6834b94adaeb3ead77c109caa17
SHA256

a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485
SHA512

d473d1eac124ae7bc8bd6640ee1e1cc5bf0c18439dd0b2c924ba658d228a5c7d12fd8c2d2610edd9ebb2c07a314d78aa20c41b5396ecada22bf26e0e175fdae8
SSDEEP

384:Piv9NM67LuJP7xaQ0xh5K+BrIyucYetD++xh1iyzknYjc5SamYhNcngkB:P0fMrL0xhNBBYetDxhY1Yjcw3vngW

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
3536	taskkill.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IE	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IE\ = "????"	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IE\NeverShowExt = "1"	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IE\shell\open\command	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IE\shell\open\command\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE "	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.IE	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IE\shell	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IE\shell\open	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IE\DefaultIcon	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IE\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE,0"	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.IE\ = "IE"	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4688	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3068	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
3068	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3068	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
Token: SeDebugPrivilege	3536	taskkill.exe
Token: SeDebugPrivilege	3068	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
Token: SeDebugPrivilege	3068	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
Token: SeDebugPrivilege	3068	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
Token: SeDebugPrivilege	3068	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3068	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 3536	3068	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe	81
PID 3068 wrote to memory of 3536	3068	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe	81
PID 3068 wrote to memory of 3536	3068	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe	81
PID 3068 wrote to memory of 4116	3068	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe	83
PID 3068 wrote to memory of 4116	3068	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe	83
PID 3068 wrote to memory of 4116	3068	a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe	83
PID 4116 wrote to memory of 4688	4116	cmd.exe	86
PID 4116 wrote to memory of 4688	4116	cmd.exe	86
PID 4116 wrote to memory of 4688	4116	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe
"C:\Users\Admin\AppData\Local\Temp\a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im ZhuDongFangyu.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3536
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 1 && del "C:\Users\Admin\AppData\Local\Temp\a7c8287c87e83fd9424715a5565272629a22c7f3f0d7ddd6203436da46d2d485.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 1
    3⤵
    - Runs ping.exe
    PID:4688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3068-132-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3068-137-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads