c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506

General

Target

c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
Size

30.2MB
MD5

1605aa6fbee78c96ff447329bab67eab
SHA1

9160b0ed553af0558b546bb502cb8adade2603b8
SHA256

c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506
SHA512

7979420989b13c8be1a972feb2183b497ff71e1e4011dd2ce5a9d576b2bd30a5f001b2c61265fec1b03f56455237a55cb2a8b386313a12352fb75e94f573f318
SSDEEP

786432:4ozpu++IKrQWnkZqy2oVlksGkNaQdgYKKf2RRUCRI:4opu+lWni2oVlECcYu/Q

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2016	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
2016	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
2016	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
File opened (read-only)	\??\M:	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
File opened (read-only)	\??\R:	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
File opened (read-only)	\??\V:	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
File opened (read-only)	\??\Z:	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
File opened (read-only)	\??\X:	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
File opened (read-only)	\??\E:	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
File opened (read-only)	\??\I:	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
File opened (read-only)	\??\J:	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
File opened (read-only)	\??\L:	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
File opened (read-only)	\??\Q:	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
File opened (read-only)	\??\W:	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
File opened (read-only)	\??\A:	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
File opened (read-only)	\??\B:	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
File opened (read-only)	\??\G:	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
File opened (read-only)	\??\H:	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
File opened (read-only)	\??\P:	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
File opened (read-only)	\??\T:	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
File opened (read-only)	\??\K:	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
File opened (read-only)	\??\N:	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
File opened (read-only)	\??\O:	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
File opened (read-only)	\??\S:	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
File opened (read-only)	\??\U:	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
File opened (read-only)	\??\Y:	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
2016	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
2016	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
2016	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
2016	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
2016	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
2016	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
2016	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
2016	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
2016	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
2016	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
2016	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
2016	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
2016	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
2016	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
2016	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
2016	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
2016	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
2016	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
2016	c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe

C:\Users\Admin\AppData\Local\Temp\c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe
"C:\Users\Admin\AppData\Local\Temp\c8a0505037e5f115b2950417b082a27afbf60d7309853657fd41662dec83a506.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:2016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\°²×°Æ÷\EThread.fne

Filesize
60KB

MD5
f15e1f51d13e014e388256e1b3255173

SHA1
505b242e5bc0091e457c94b5db322da2bec6e60d

SHA256
6c9f4380c83cd9fc04f70dccd872452d2ab53e650def941746076e83c638f410

SHA512
3862ab998afd3e5fb1ed3aecc31fbd9d38adfda1cd2bcc31026b9502a495410725f91bf874cd1e42c0b1ece55a6e53aaf69092c11812644b2f3ff3d698780011

Download Submit
\Users\Admin\AppData\Local\Temp\°²×°Æ÷\com.run

Filesize
264KB

MD5
391c2455faa0776472ab023842b0eec7

SHA1
138e08ce20281bfebbf359c99de1f8c68237354d

SHA256
6003808911640cf24f503f89477a5a38c3cbadd69562163b4a035af72595edfa

SHA512
f9e54372e2b8daa737cc71ac4d2b4ef942ba85465f176f3a084644961775c825c917fbb36e8247b630427c8f479a4e2c318bbfe47a47ffa2bf17aa8c420c5c23

Download Submit
\Users\Admin\AppData\Local\Temp\°²×°Æ÷\krnln.fnr

Filesize
1.2MB

MD5
bc9c545c2936301b5baf3a2963818d13

SHA1
c6e50e4428863fbe0525dbd0d9c499d60dfc9c0b

SHA256
e4f23d4d03b66a49282cafc0dbdd7f8694d41869dead72b8f788c210ea42e504

SHA512
ad6cf852d27345fe99134422608c99fbf4bdeb6ccd95f73200af982c72ede344b2f7aba6e8b65a9b4919a072939252d10d06740a494fdd4cd990570c9b4c1e44

Download Submit
memory/2016-64-0x00000000078F0000-0x00000000078FA000-memory.dmp

Filesize
40KB

Download
memory/2016-66-0x00000000078F0000-0x00000000078FA000-memory.dmp

Filesize
40KB

Download
memory/2016-59-0x0000000004330000-0x000000000437B000-memory.dmp

Filesize
300KB

Download
memory/2016-57-0x0000000000400000-0x0000000001C9E000-memory.dmp

Filesize
24.6MB

Download
memory/2016-61-0x0000000003DC0000-0x0000000003DDC000-memory.dmp

Filesize
112KB

Download
memory/2016-62-0x00000000078F0000-0x00000000078FA000-memory.dmp

Filesize
40KB

Download
memory/2016-63-0x00000000078F0000-0x00000000078FA000-memory.dmp

Filesize
40KB

Download
memory/2016-55-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download
memory/2016-65-0x00000000078F0000-0x00000000078FA000-memory.dmp

Filesize
40KB

Download
memory/2016-58-0x0000000010000000-0x000000001014B000-memory.dmp

Filesize
1.3MB

Download
memory/2016-68-0x00000000078F0000-0x00000000078FA000-memory.dmp

Filesize
40KB

Download
memory/2016-67-0x00000000078F0000-0x00000000078FA000-memory.dmp

Filesize
40KB

Download
memory/2016-69-0x00000000078F0000-0x00000000078FA000-memory.dmp

Filesize
40KB

Download
memory/2016-70-0x00000000078F0000-0x00000000078FA000-memory.dmp

Filesize
40KB

Download
memory/2016-71-0x00000000078F0000-0x00000000078FA000-memory.dmp

Filesize
40KB

Download
memory/2016-72-0x00000000078F0000-0x00000000078FA000-memory.dmp

Filesize
40KB

Download
memory/2016-73-0x0000000010000000-0x000000001014B000-memory.dmp

Filesize
1.3MB

Download
memory/2016-74-0x0000000004330000-0x000000000437B000-memory.dmp

Filesize
300KB

Download

Analysis

Sharing