0270c6f93258e6b7c079c1dd0114ebf8846bd5a3a1cd375b875195a280bada05

General

Target

0270c6f93258e6b7c079c1dd0114ebf8846bd5a3a1cd375b875195a280bada05.exe
Size

229KB
MD5

a0d620a0cab01b9dc1e505c2d6a810b0
SHA1

5e5bf4e666b8c1746fbd5ee9e578e75ffcc454d7
SHA256

0270c6f93258e6b7c079c1dd0114ebf8846bd5a3a1cd375b875195a280bada05
SHA512

b30a84baae78e730d836c720cdf4de69c48a81709466adce7df80fc33526faeecf34103a4b8528824805014d0ea70b5367a43b4714218c307cc242017338345c
SSDEEP

3072:2DPhT7lKbVfldRMtyyYyzwCv2gs3+7K75pP:2DR7lKbtlMg/yzNG+7K75pP

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Serverx = "C:\\Windows\\system32\\Serverx.exe"	0270c6f93258e6b7c079c1dd0114ebf8846bd5a3a1cd375b875195a280bada05.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Serverx.exe	0270c6f93258e6b7c079c1dd0114ebf8846bd5a3a1cd375b875195a280bada05.exe
File opened for modification	C:\Windows\SysWOW64\Serverx.exe	0270c6f93258e6b7c079c1dd0114ebf8846bd5a3a1cd375b875195a280bada05.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	0270c6f93258e6b7c079c1dd0114ebf8846bd5a3a1cd375b875195a280bada05.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe	0270c6f93258e6b7c079c1dd0114ebf8846bd5a3a1cd375b875195a280bada05.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	0270c6f93258e6b7c079c1dd0114ebf8846bd5a3a1cd375b875195a280bada05.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe	0270c6f93258e6b7c079c1dd0114ebf8846bd5a3a1cd375b875195a280bada05.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe	0270c6f93258e6b7c079c1dd0114ebf8846bd5a3a1cd375b875195a280bada05.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe	0270c6f93258e6b7c079c1dd0114ebf8846bd5a3a1cd375b875195a280bada05.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe	0270c6f93258e6b7c079c1dd0114ebf8846bd5a3a1cd375b875195a280bada05.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	0270c6f93258e6b7c079c1dd0114ebf8846bd5a3a1cd375b875195a280bada05.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe	0270c6f93258e6b7c079c1dd0114ebf8846bd5a3a1cd375b875195a280bada05.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe	0270c6f93258e6b7c079c1dd0114ebf8846bd5a3a1cd375b875195a280bada05.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	0270c6f93258e6b7c079c1dd0114ebf8846bd5a3a1cd375b875195a280bada05.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE	0270c6f93258e6b7c079c1dd0114ebf8846bd5a3a1cd375b875195a280bada05.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	0270c6f93258e6b7c079c1dd0114ebf8846bd5a3a1cd375b875195a280bada05.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	0270c6f93258e6b7c079c1dd0114ebf8846bd5a3a1cd375b875195a280bada05.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	0270c6f93258e6b7c079c1dd0114ebf8846bd5a3a1cd375b875195a280bada05.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 1484	948	0270c6f93258e6b7c079c1dd0114ebf8846bd5a3a1cd375b875195a280bada05.exe	28
PID 948 wrote to memory of 1484	948	0270c6f93258e6b7c079c1dd0114ebf8846bd5a3a1cd375b875195a280bada05.exe	28
PID 948 wrote to memory of 1484	948	0270c6f93258e6b7c079c1dd0114ebf8846bd5a3a1cd375b875195a280bada05.exe	28
PID 948 wrote to memory of 1484	948	0270c6f93258e6b7c079c1dd0114ebf8846bd5a3a1cd375b875195a280bada05.exe	28
PID 948 wrote to memory of 1432	948	0270c6f93258e6b7c079c1dd0114ebf8846bd5a3a1cd375b875195a280bada05.exe	15
PID 948 wrote to memory of 1432	948	0270c6f93258e6b7c079c1dd0114ebf8846bd5a3a1cd375b875195a280bada05.exe	15

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1432
- C:\Users\Admin\AppData\Local\Temp\0270c6f93258e6b7c079c1dd0114ebf8846bd5a3a1cd375b875195a280bada05.exe
  "C:\Users\Admin\AppData\Local\Temp\0270c6f93258e6b7c079c1dd0114ebf8846bd5a3a1cd375b875195a280bada05.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Users\Admin\AppData\Local\Temp\0270c6f93258e6b7c079c1dd0114ebf8846bd5a3a1cd375b875195a280bada05.exe
    "C:\Users\Admin\AppData\Local\Temp\0270c6f93258e6b7c079c1dd0114ebf8846bd5a3a1cd375b875195a280bada05.exe"
    3⤵
    PID:1484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/948-54-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/948-59-0x0000000001000000-0x0000000001040000-memory.dmp

Filesize
256KB

Download
memory/948-60-0x0000000000630000-0x0000000000670000-memory.dmp

Filesize
256KB

Download
memory/948-63-0x0000000001000000-0x0000000001040000-memory.dmp

Filesize
256KB

Download
memory/1432-57-0x00000000026E0000-0x00000000026E1000-memory.dmp

Filesize
4KB

Download
memory/1484-61-0x0000000001000000-0x0000000001040000-memory.dmp

Filesize
256KB

Download
memory/1484-62-0x0000000001000000-0x0000000001040000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing