969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc

General

Target
969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe
Size 225KB
Sample221016-y3acraabe2
SHA256 969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc
MD5 7ae6806d0fbcc762a5a58a6e60e2ff9e
SHA1 1cb7e2ab7012990bd5051120c3ef8a438035aa88
SHA512 7baaf507843e94b74adc11b9c9647e96074345e774a179bf8150d03202ce575185e183dde940ca91fef4ae7a3eab6c66e4347dc48c972e04b2973257620413a7
SSDEEP 6144:ExJmXaQwAhgEkJ8kNV50DErsMxgTw7ozFD254W:EXeaQwAE89DEGcopfW
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2008	969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
1636	netsh.exe

Deletes itself 1 IoCs

pid	Process
2036	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe = "C:\\Windows\\969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe"	969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	\??\E:\$RECYCLE.BIN\S-1-5-21-4063495947-34355257-727531523-1000\desktop.ini	969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe
File opened (read-only)	\??\F:	969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe	969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe
File created	C:\Windows\26500689511972527219.png	969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
2028	taskkill.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.venus\DefaultIcon	969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.venus\DefaultIcon\ = "C:\\Windows\\26500689511972527219.png"	969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.venus	969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2020	PING.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2008	969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe
Token: SeTcbPrivilege	2008	969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe
Token: SeTakeOwnershipPrivilege	2008	969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe
Token: SeSecurityPrivilege	2008	969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe
Token: SeDebugPrivilege	2028	taskkill.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 2008	1200	969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe	27
PID 1200 wrote to memory of 2008	1200	969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe	27
PID 1200 wrote to memory of 2008	1200	969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe	27
PID 1200 wrote to memory of 2008	1200	969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe	27
PID 1200 wrote to memory of 2036	1200	969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe	28
PID 1200 wrote to memory of 2036	1200	969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe	28
PID 1200 wrote to memory of 2036	1200	969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe	28
PID 1200 wrote to memory of 2036	1200	969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe	28
PID 2036 wrote to memory of 2020	2036	cmd.exe	30
PID 2036 wrote to memory of 2020	2036	cmd.exe	30
PID 2036 wrote to memory of 2020	2036	cmd.exe	30
PID 2008 wrote to memory of 1468	2008	969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe	31
PID 2008 wrote to memory of 1468	2008	969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe	31
PID 2008 wrote to memory of 1468	2008	969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe	31
PID 2008 wrote to memory of 1468	2008	969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe	31
PID 2008 wrote to memory of 1624	2008	969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe	33
PID 2008 wrote to memory of 1624	2008	969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe	33
PID 2008 wrote to memory of 1624	2008	969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe	33
PID 2008 wrote to memory of 1624	2008	969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe	33
PID 1468 wrote to memory of 1636	1468	cmd.exe	35
PID 1468 wrote to memory of 1636	1468	cmd.exe	35
PID 1468 wrote to memory of 1636	1468	cmd.exe	35
PID 1624 wrote to memory of 2028	1624	cmd.exe	36
PID 1624 wrote to memory of 2028	1624	cmd.exe	36
PID 1624 wrote to memory of 2028	1624	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe
"C:\Users\Admin\AppData\Local\Temp\969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe
  "C:\Windows\969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe" g g g o n e123
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\System32\cmd.exe
    /C netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1468
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes
      4⤵
      Modifies Windows Firewall
      PID:1636
- - C:\Windows\System32\cmd.exe
    /C taskkill /F /IM msftesql.exe /IM sqlagent.exe /IM sqlbrowser.exe /IM sqlservr.exe /IM sqlwriter.exe /IM oracle.exe /IM ocssd.exe /IM dbsnmp.exe /IM synctime.exe /IM mydesktopqos.exe /IM agntsvc.exe /IM isqlplussvc.exe /IM xfssvccon.exe /IM mydesktopservice.exe /IM ocautoupds.exe /IM agntsvc.exe /IM agntsvc.exe /IM agntsvc.exe /IM encsvc.exe /IM firefoxconfig.exe /IM tbirdconfig.exe /IM ocomm.exe /IM mysqld.exe /IM mysqld-nt.exe /IM mysqld-opt.exe /IM dbeng50.exe /IM sqbcoreservice.exe /IM excel.exe /IM infopath.exe /IM msaccess.exe /IM mspub.exe /IM onenote.exe /IM outlook.exe /IM powerpnt.exe /IM sqlservr.exe /IM thebat64.exe /IM thunderbird.exe /IM winword.exe /IM wordpad.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1624
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM msftesql.exe /IM sqlagent.exe /IM sqlbrowser.exe /IM sqlservr.exe /IM sqlwriter.exe /IM oracle.exe /IM ocssd.exe /IM dbsnmp.exe /IM synctime.exe /IM mydesktopqos.exe /IM agntsvc.exe /IM isqlplussvc.exe /IM xfssvccon.exe /IM mydesktopservice.exe /IM ocautoupds.exe /IM agntsvc.exe /IM agntsvc.exe /IM agntsvc.exe /IM encsvc.exe /IM firefoxconfig.exe /IM tbirdconfig.exe /IM ocomm.exe /IM mysqld.exe /IM mysqld-nt.exe /IM mysqld-opt.exe /IM dbeng50.exe /IM sqbcoreservice.exe /IM excel.exe /IM infopath.exe /IM msaccess.exe /IM mspub.exe /IM onenote.exe /IM outlook.exe /IM powerpnt.exe /IM sqlservr.exe /IM thebat64.exe /IM thunderbird.exe /IM winword.exe /IM wordpad.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2028
- C:\Windows\System32\cmd.exe
  /c ping localhost -n 3 > nul & del C:\Users\Admin\AppData\Local\Temp\969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\system32\PING.EXE
    ping localhost -n 3
    3⤵
    - Runs ping.exe
    PID:2020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe

Path C:\Windows\969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc.bin.exe
Size 225KB
SHA256 969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc
MD5 7ae6806d0fbcc762a5a58a6e60e2ff9e
SHA1 1cb7e2ab7012990bd5051120c3ef8a438035aa88
SHA512 7baaf507843e94b74adc11b9c9647e96074345e774a179bf8150d03202ce575185e183dde940ca91fef4ae7a3eab6c66e4347dc48c972e04b2973257620413a7
SSDEEP 6144:ExJmXaQwAhgEkJ8kNV50DErsMxgTw7ozFD254W:EXeaQwAE89DEGcopfW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1200-58-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1200-54-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Download

memory/1636-65-0x000007FEFC001000-0x000007FEFC003000-memory.dmp

Download

memory/2008-66-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2008-67-0x0000000000400000-0x000000000043E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads