66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941

General

Target

66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941.exe
Size

263KB
MD5

091a755f09eb9cb26392f98c34b36b05
SHA1

a14ad79c990961641eb3ef2236c1c95c28425483
SHA256

66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941
SHA512

e2df2c281110c6cdf8b70d99493be00eb2c02a73520657ffdcebe04db98e616fd4d9b78ac1762998984bfda2fa96c7c5c92bf59bb237c36dd3921cced1843f82
SSDEEP

6144:2bVzcyAtAV9LZpXcs4xXsQ0fuCxmN07CgCr0QWZ7zeVNs26S8TvfIgj8:20ClpMsk70fuEf7Cr03eDhivk

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3940	mhtop32bit.exe

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1484-132-0x0000000000400000-0x00000000004A7000-memory.dmp	upx
behavioral2/files/0x0004000000022daa-135.dat	upx
behavioral2/files/0x0004000000022daa-136.dat	upx
behavioral2/memory/3940-137-0x0000000000400000-0x00000000004A7000-memory.dmp	upx
behavioral2/memory/1484-138-0x0000000000400000-0x00000000004A7000-memory.dmp	upx
behavioral2/memory/3940-139-0x0000000000400000-0x00000000004A7000-memory.dmp	upx
behavioral2/memory/3940-143-0x0000000000400000-0x00000000004A7000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	mhtop32bit.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MarvelHost = "┢偁䑐呁╁浜瑨灯㈳楢\u2e74硥≥"	66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MarvelHost = "┢偁䑐呁╁浜瑨灯㈳楢\u2e74硥≥"	66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3728	3040	WerFault.exe	67
4304	1424	WerFault.exe	96

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-929662420-1054238289-2961194603-1000\{D7472D30-6807-4B59-B073-C9A0CC03EAC4}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	mhtop32bit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1424	explorer.exe
Token: SeCreatePagefilePrivilege	1424	explorer.exe
Token: SeShutdownPrivilege	1424	explorer.exe
Token: SeCreatePagefilePrivilege	1424	explorer.exe
Token: SeShutdownPrivilege	1424	explorer.exe
Token: SeCreatePagefilePrivilege	1424	explorer.exe
Token: SeShutdownPrivilege	1424	explorer.exe
Token: SeCreatePagefilePrivilege	1424	explorer.exe
Token: SeShutdownPrivilege	1424	explorer.exe
Token: SeCreatePagefilePrivilege	1424	explorer.exe
Token: SeShutdownPrivilege	1424	explorer.exe
Token: SeCreatePagefilePrivilege	1424	explorer.exe
Token: SeShutdownPrivilege	1424	explorer.exe
Token: SeCreatePagefilePrivilege	1424	explorer.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1424	explorer.exe
1424	explorer.exe
1424	explorer.exe
1424	explorer.exe
1424	explorer.exe
1424	explorer.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
1424	explorer.exe
1424	explorer.exe
1424	explorer.exe
1424	explorer.exe
1424	explorer.exe
1424	explorer.exe
1424	explorer.exe
1424	explorer.exe
1424	explorer.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 1832	1484	66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941.exe	84
PID 1484 wrote to memory of 1832	1484	66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941.exe	84
PID 1484 wrote to memory of 1832	1484	66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941.exe	84
PID 1484 wrote to memory of 3940	1484	66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941.exe	86
PID 1484 wrote to memory of 3940	1484	66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941.exe	86
PID 1484 wrote to memory of 3940	1484	66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941.exe	86
PID 3940 wrote to memory of 5092	3940	mhtop32bit.exe	97
PID 3940 wrote to memory of 5092	3940	mhtop32bit.exe	97
PID 3940 wrote to memory of 5092	3940	mhtop32bit.exe	97

C:\Users\Admin\AppData\Local\Temp\66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941.exe
"C:\Users\Admin\AppData\Local\Temp\66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941.exe" "%APPDATA%\mhtop32bit.exe"
  2⤵
  PID:1832
- C:\Users\Admin\AppData\Roaming\mhtop32bit.exe
  C:\Users\Admin\AppData\Roaming\mhtop32bit.exe
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Roaming\Decryptor_Info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    PID:5092

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 420 -p 3040 -ip 3040
1⤵
PID:2164

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3040 -s 5968
1⤵
- Program crash
PID:3728

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1424
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1424 -s 2292
  2⤵
  - Program crash
  PID:4304

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 360 -p 1424 -ip 1424
1⤵
PID:4132

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db.[[email protected]].termit

Filesize
289KB

MD5
2b5b65cd1db879f9efc1971482206788

SHA1
8bd335323127ffb7849e12e20b5f5c49e8808ff7

SHA256
99505b8a78e76aff8db56d860185eadeabf61fceffa14330bcc3b5acbbd136c1

SHA512
369862eabc4e1ca80292787d5f005033c0eead31c8c8f578af6d51f22c9897720b72c9bb16a1a9f22de3086f7c982ef377e82ccc947522cb45d9223d822531fe

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.[[email protected]].termit

Filesize
623KB

MD5
3e9b4993172267225fb6bc840d40cb63

SHA1
a851775486864916c909a93aa9bde954af6d17a2

SHA256
707c5277a8109d0cc7bd914ceddf4e8cd5cd818fabdcaa6b165b5eb541019697

SHA512
ecabd54bc1ade30520db9cc78b30e1390ed4bcee1256f4363dab82def2a0f9faec573b324fd96351862a72fb79af3d77e6a9e012bfc58a014129b542cce77577

Download Submit
C:\Users\Admin\AppData\Roaming\Decryptor_Info.hta

Filesize
2KB

MD5
962124a14c835203ef5df8d9bc12a310

SHA1
e3c87c22c798e6ec6eaf0d1fd17b183ca651ea2b

SHA256
1f509b7c1fb5206bb3e95cb324e1741aebd7d71a89de2ea7f0cdaf02ad21c366

SHA512
9d0a1432e06117706d3425c4b7fa659aab10b3d2cc07e2c26af6999668ad2918eca7d36bdb50243b98b33a13c1044541509854a21e2194b498f17ff126c1bfe6

Download Submit
C:\Users\Admin\AppData\Roaming\mhtop32bit.exe

Filesize
263KB

MD5
091a755f09eb9cb26392f98c34b36b05

SHA1
a14ad79c990961641eb3ef2236c1c95c28425483

SHA256
66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941

SHA512
e2df2c281110c6cdf8b70d99493be00eb2c02a73520657ffdcebe04db98e616fd4d9b78ac1762998984bfda2fa96c7c5c92bf59bb237c36dd3921cced1843f82

Download Submit
C:\Users\Admin\AppData\Roaming\mhtop32bit.exe

Filesize
263KB

MD5
091a755f09eb9cb26392f98c34b36b05

SHA1
a14ad79c990961641eb3ef2236c1c95c28425483

SHA256
66dc874b9718b3857640c6943b9009084d7ac564f0891b2fa9878a833c52a941

SHA512
e2df2c281110c6cdf8b70d99493be00eb2c02a73520657ffdcebe04db98e616fd4d9b78ac1762998984bfda2fa96c7c5c92bf59bb237c36dd3921cced1843f82

Download Submit
memory/1484-138-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/1484-132-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/3940-137-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/3940-139-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/3940-143-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads