fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201

General

Target
fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201.exe
Size 1.0MB
Sample221012-t8hh4acab5
SHA256 fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201
MD5 7ad64650479b9da69873612bb4d18e5d
SHA1 48f180db36159873515ea60ee21771e9fd7e561d
SHA512 b161ac768fee2bcc2bc91d8f22b83f6555e1b1b856b7207afe69972bfc3685b38e613b2e00dbc762dfd45c6e35b80b020a70a34b11ca14a0d98e34771d71e7b4
SSDEEP 12288:Z6SKqT31T6WpJY6V765jKqostkm3Ob/Jnq1wqDwKssa1:oxqT31T6WE6I5jKqosOm+b/Jnuf3a1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe csrcs.exe"	fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\csrcs = "C:\\Windows\\system32\\csrcs.exe"	fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201.exe

Executes dropped EXE 1 IoCs

pid	Process
4996	csrcs.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000b000000022df3-134.dat	autoit_exe
behavioral2/files/0x000b000000022df3-133.dat	autoit_exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\csrcs.exe	fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201.exe
File opened for modification	C:\Windows\SysWOW64\csrcs.exe	fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
4356	PING.EXE
4216	PING.EXE
2648	PING.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5032	fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201.exe
5032	fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201.exe
5032	fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201.exe
5032	fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201.exe
5032	fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201.exe
5032	fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201.exe
4996	csrcs.exe
4996	csrcs.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 4996	5032	fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201.exe	83
PID 5032 wrote to memory of 4996	5032	fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201.exe	83
PID 5032 wrote to memory of 4996	5032	fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201.exe	83
PID 4996 wrote to memory of 3968	4996	csrcs.exe	85
PID 4996 wrote to memory of 3968	4996	csrcs.exe	85
PID 4996 wrote to memory of 3968	4996	csrcs.exe	85
PID 3968 wrote to memory of 4356	3968	cmd.exe	87
PID 3968 wrote to memory of 4356	3968	cmd.exe	87
PID 3968 wrote to memory of 4356	3968	cmd.exe	87
PID 5032 wrote to memory of 3392	5032	fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201.exe	88
PID 5032 wrote to memory of 3392	5032	fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201.exe	88
PID 5032 wrote to memory of 3392	5032	fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201.exe	88
PID 3392 wrote to memory of 4216	3392	cmd.exe	90
PID 3392 wrote to memory of 4216	3392	cmd.exe	90
PID 3392 wrote to memory of 4216	3392	cmd.exe	90
PID 3968 wrote to memory of 2648	3968	cmd.exe	91
PID 3968 wrote to memory of 2648	3968	cmd.exe	91
PID 3968 wrote to memory of 2648	3968	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201.exe
"C:\Users\Admin\AppData\Local\Temp\fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Adds policy Run key to start application
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\SysWOW64\csrcs.exe
  "C:\Windows\System32\csrcs.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\suicide.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3968
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 5 -w 250 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4356
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 5 -w 250 127.0.0.1
      4⤵
      Runs ping.exe
      PID:2648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\suicide.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3392
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 5 -w 250 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4216

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

suicide.bat

Path C:\Users\Admin\AppData\Local\Temp\suicide.bat
Size 141B
SHA256 19f0453504f36aef7d207f11345ed203440a3a8dd1594df1aa072b2f4eeb39bf
MD5 9d7ddbc6c331aefed77908f803fca1e5
SHA1 d36afa796236730342b216f083c68a39227c13bf
SHA512 014c7cb15ec0bfc96e1f5b5a66b0bba9b87440256d0e8d9106cef8c4d2f1d244a3063a7abb847957310b2e0c9db466291851d7bb2ff8e6b50e0b9ad907b9b54c
MD5 SHA1 SHA512

Submit Download

suicide.bat

Path C:\Users\Admin\AppData\Local\Temp\suicide.bat
Size 287B
SHA256 964d2d7382c8e6b904e8f2655710f213e703a6b71c397da02f43212a8828b01b
MD5 663745483a958e248bb59a3602349328
SHA1 8e105460c50b29958eab792812d401e6d3be5f76
SHA512 d9d24b5f7b6c3e1041b31935d83dfee09a9127a9ad071cb18d1a6ebcdc0b89f5bec684046ed8e48af6b44a4620869337ba43660ea9471a9eb9934039ca76b1e0
MD5 SHA1 SHA512

Submit Download

csrcs.exe

Path C:\Windows\SysWOW64\csrcs.exe
Size 1.0MB
SHA256 fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201
MD5 7ad64650479b9da69873612bb4d18e5d
SHA1 48f180db36159873515ea60ee21771e9fd7e561d
SHA512 b161ac768fee2bcc2bc91d8f22b83f6555e1b1b856b7207afe69972bfc3685b38e613b2e00dbc762dfd45c6e35b80b020a70a34b11ca14a0d98e34771d71e7b4
SSDEEP 12288:Z6SKqT31T6WpJY6V765jKqostkm3Ob/Jnq1wqDwKssa1:oxqT31T6WE6I5jKqosOm+b/Jnuf3a1
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrcs.exe

Path C:\Windows\SysWOW64\csrcs.exe
Size 1.0MB
SHA256 fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201
MD5 7ad64650479b9da69873612bb4d18e5d
SHA1 48f180db36159873515ea60ee21771e9fd7e561d
SHA512 b161ac768fee2bcc2bc91d8f22b83f6555e1b1b856b7207afe69972bfc3685b38e613b2e00dbc762dfd45c6e35b80b020a70a34b11ca14a0d98e34771d71e7b4
SSDEEP 12288:Z6SKqT31T6WpJY6V765jKqostkm3Ob/Jnq1wqDwKssa1:oxqT31T6WE6I5jKqosOm+b/Jnuf3a1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads