11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8

General

Target

11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe
Size

60KB
MD5

921532d96f4b89101035374a84f9ffe0
SHA1

dd72f16d97f810da90af0c12fc26999a7a2e455f
SHA256

11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8
SHA512

23ed51f061d5b15110324fa948a97670a0e42bb7494146da4dae03d1e11f2d6cbb85035b54bace396e7f15b70f135bd34d490baf8634ff76daf1086b58369a78
SSDEEP

1536:8KqxQGmzLOJXEm5pnnvKfM0cu5tz9r4KbBi6GePt:Ej4kEm76cOzJbi6Ge

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 15 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\	11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\UpdateSvchost = "C:\\Users\\Admin\\AppData\\Roaming\\nightupdate\\svchost.exe:*:Enabled:svchost"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\UpdateSvchost = "C:\\Users\\Admin\\AppData\\Roaming\\nightupdate\\svchost.exe:*:Enabled:svchost"	11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\UpdateSvchost = "C:\\Users\\Admin\\AppData\\Roaming\\nightupdate\\svchost.exe:*:Enabled:svchost"	svchost.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	svchost.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\	11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\UpdateSvchost = "C:\\Users\\Admin\\AppData\\Roaming\\nightupdate\\svchost.exe:*:Enabled:svchost"	11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2388	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UpdateSvchost = "C:\\Users\\Admin\\AppData\\Roaming\\nightupdate\\svchost.exe"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\	11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UpdateSvchost = "C:\\Users\\Admin\\AppData\\Roaming\\nightupdate\\svchost.exe"	11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 2388	1540	11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe	83
PID 1540 wrote to memory of 2388	1540	11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe	83
PID 1540 wrote to memory of 2388	1540	11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe	83

C:\Users\Admin\AppData\Local\Temp\11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe
"C:\Users\Admin\AppData\Local\Temp\11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe"
1⤵
- Modifies firewall policy service
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Users\Admin\AppData\Roaming\nightupdate\svchost.exe
  "C:\Users\Admin\AppData\Roaming\nightupdate\svchost.exe"
  2⤵
  - Modifies firewall policy service
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\nightupdate\svchost.exe

Filesize
60KB

MD5
921532d96f4b89101035374a84f9ffe0

SHA1
dd72f16d97f810da90af0c12fc26999a7a2e455f

SHA256
11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8

SHA512
23ed51f061d5b15110324fa948a97670a0e42bb7494146da4dae03d1e11f2d6cbb85035b54bace396e7f15b70f135bd34d490baf8634ff76daf1086b58369a78

Download Submit
C:\Users\Admin\AppData\Roaming\nightupdate\svchost.exe

Filesize
60KB

MD5
921532d96f4b89101035374a84f9ffe0

SHA1
dd72f16d97f810da90af0c12fc26999a7a2e455f

SHA256
11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8

SHA512
23ed51f061d5b15110324fa948a97670a0e42bb7494146da4dae03d1e11f2d6cbb85035b54bace396e7f15b70f135bd34d490baf8634ff76daf1086b58369a78

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads