66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941

General

Target

66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941.exe
Size

263KB
MD5

091a755f09eb9cb26392f98c34b36b05
SHA1

a14ad79c990961641eb3ef2236c1c95c28425483
SHA256

66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941
SHA512

e2df2c281110c6cdf8b70d99493be00eb2c02a73520657ffdcebe04db98e616fd4d9b78ac1762998984bfda2fa96c7c5c92bf59bb237c36dd3921cced1843f82
SSDEEP

6144:2bVzcyAtAV9LZpXcs4xXsQ0fuCxmN07CgCr0QWZ7zeVNs26S8TvfIgj8:20ClpMsk70fuEf7Cr03eDhivk

Score

8^/10

persistence ransomware spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1112	mhtop32bit.exe

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\ExportUnblock.tiff	mhtop32bit.exe
File opened for modification	C:\Users\Admin\Pictures\MeasurePop.tiff	mhtop32bit.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1912-55-0x0000000000400000-0x00000000004A7000-memory.dmp	upx
behavioral1/files/0x00140000000054ab-57.dat	upx
behavioral1/files/0x00140000000054ab-58.dat	upx
behavioral1/files/0x00140000000054ab-60.dat	upx
behavioral1/memory/1912-62-0x0000000000400000-0x00000000004A7000-memory.dmp	upx
behavioral1/memory/1112-63-0x0000000000400000-0x00000000004A7000-memory.dmp	upx
behavioral1/memory/1112-64-0x0000000000400000-0x00000000004A7000-memory.dmp	upx
behavioral1/memory/1112-66-0x0000000000400000-0x00000000004A7000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
1912	66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MarvelHost = "┢偁䑐呁╁浜瑨灯㈳楢\u2e74硥≥"	66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MarvelHost = "┢偁䑐呁╁浜瑨灯㈳楢\u2e74硥≥"	66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
612	1256	WerFault.exe	16

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 1144	1912	66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941.exe	28
PID 1912 wrote to memory of 1144	1912	66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941.exe	28
PID 1912 wrote to memory of 1144	1912	66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941.exe	28
PID 1912 wrote to memory of 1144	1912	66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941.exe	28
PID 1912 wrote to memory of 1112	1912	66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941.exe	30
PID 1912 wrote to memory of 1112	1912	66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941.exe	30
PID 1912 wrote to memory of 1112	1912	66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941.exe	30
PID 1912 wrote to memory of 1112	1912	66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941.exe	30
PID 1112 wrote to memory of 1036	1112	mhtop32bit.exe	33
PID 1112 wrote to memory of 1036	1112	mhtop32bit.exe	33
PID 1112 wrote to memory of 1036	1112	mhtop32bit.exe	33
PID 1112 wrote to memory of 1036	1112	mhtop32bit.exe	33

C:\Users\Admin\AppData\Local\Temp\66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941.exe
"C:\Users\Admin\AppData\Local\Temp\66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941.exe" "%APPDATA%\mhtop32bit.exe"
  2⤵
  PID:1144
- C:\Users\Admin\AppData\Roaming\mhtop32bit.exe
  C:\Users\Admin\AppData\Roaming\mhtop32bit.exe
  2⤵
  - Executes dropped EXE
  - Modifies extensions of user files
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Roaming\Decryptor_Info.hta"
    3⤵
    - Modifies Internet Explorer settings
    PID:1036

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1256 -s 2952
1⤵
- Program crash
PID:612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Decryptor_Info.hta

Filesize
2KB

MD5
962124a14c835203ef5df8d9bc12a310

SHA1
e3c87c22c798e6ec6eaf0d1fd17b183ca651ea2b

SHA256
1f509b7c1fb5206bb3e95cb324e1741aebd7d71a89de2ea7f0cdaf02ad21c366

SHA512
9d0a1432e06117706d3425c4b7fa659aab10b3d2cc07e2c26af6999668ad2918eca7d36bdb50243b98b33a13c1044541509854a21e2194b498f17ff126c1bfe6

Download Submit
C:\Users\Admin\AppData\Roaming\mhtop32bit.exe

Filesize
263KB

MD5
091a755f09eb9cb26392f98c34b36b05

SHA1
a14ad79c990961641eb3ef2236c1c95c28425483

SHA256
66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941

SHA512
e2df2c281110c6cdf8b70d99493be00eb2c02a73520657ffdcebe04db98e616fd4d9b78ac1762998984bfda2fa96c7c5c92bf59bb237c36dd3921cced1843f82

Download Submit
C:\Users\Admin\AppData\Roaming\mhtop32bit.exe

Filesize
263KB

MD5
091a755f09eb9cb26392f98c34b36b05

SHA1
a14ad79c990961641eb3ef2236c1c95c28425483

SHA256
66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941

SHA512
e2df2c281110c6cdf8b70d99493be00eb2c02a73520657ffdcebe04db98e616fd4d9b78ac1762998984bfda2fa96c7c5c92bf59bb237c36dd3921cced1843f82

Download Submit
\Users\Admin\AppData\Roaming\mhtop32bit.exe

Filesize
263KB

MD5
091a755f09eb9cb26392f98c34b36b05

SHA1
a14ad79c990961641eb3ef2236c1c95c28425483

SHA256
66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941

SHA512
e2df2c281110c6cdf8b70d99493be00eb2c02a73520657ffdcebe04db98e616fd4d9b78ac1762998984bfda2fa96c7c5c92bf59bb237c36dd3921cced1843f82

Download Submit
memory/1112-63-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/1112-64-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/1112-66-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/1912-54-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download
memory/1912-62-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/1912-55-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads