e29e1de814efcf834f84237c90abd2d2182a03be5ddad212791ded92e2bbd9af

General

Target

e29e1de814efcf834f84237c90abd2d2182a03be5ddad212791ded92e2bbd9af.exe
Size

449KB
MD5

4ba998ebb14caf9d3abe087a55b3b170
SHA1

cc44fd5bf32dac8fdc59be33ad2d9f38f81dfc3f
SHA256

e29e1de814efcf834f84237c90abd2d2182a03be5ddad212791ded92e2bbd9af
SHA512

aefb97df4462bfbe2958f72cbcb8124afe94e02734661e2270fc5968214e11f8888bd7037d0e14f2029154ce9fffc6655b8b657c648ce30d7d0e7d36a4409ff9
SSDEEP

12288:b/kviXzd8sjomWdT0BuGDjgCElxWAufQtuN0H:ldXjFqKuGHeGfQtgM

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
956	mbagfrtqqjqcm.exe

Loads dropped DLL 4 IoCs

pid	Process
804	e29e1de814efcf834f84237c90abd2d2182a03be5ddad212791ded92e2bbd9af.exe
956	mbagfrtqqjqcm.exe
956	mbagfrtqqjqcm.exe
956	mbagfrtqqjqcm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	mbagfrtqqjqcm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	956	mbagfrtqqjqcm.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
956	mbagfrtqqjqcm.exe
956	mbagfrtqqjqcm.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 956	804	e29e1de814efcf834f84237c90abd2d2182a03be5ddad212791ded92e2bbd9af.exe	28
PID 804 wrote to memory of 956	804	e29e1de814efcf834f84237c90abd2d2182a03be5ddad212791ded92e2bbd9af.exe	28
PID 804 wrote to memory of 956	804	e29e1de814efcf834f84237c90abd2d2182a03be5ddad212791ded92e2bbd9af.exe	28
PID 804 wrote to memory of 956	804	e29e1de814efcf834f84237c90abd2d2182a03be5ddad212791ded92e2bbd9af.exe	28
PID 804 wrote to memory of 956	804	e29e1de814efcf834f84237c90abd2d2182a03be5ddad212791ded92e2bbd9af.exe	28
PID 804 wrote to memory of 956	804	e29e1de814efcf834f84237c90abd2d2182a03be5ddad212791ded92e2bbd9af.exe	28
PID 804 wrote to memory of 956	804	e29e1de814efcf834f84237c90abd2d2182a03be5ddad212791ded92e2bbd9af.exe	28

C:\Users\Admin\AppData\Local\Temp\e29e1de814efcf834f84237c90abd2d2182a03be5ddad212791ded92e2bbd9af.exe
"C:\Users\Admin\AppData\Local\Temp\e29e1de814efcf834f84237c90abd2d2182a03be5ddad212791ded92e2bbd9af.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:804
- C:\Users\Admin\AppData\Local\Temp\mbagfrtqqjqcm.exe
  "C:\Users\Admin\AppData\Local\Temp\\mbagfrtqqjqcm.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\mbagfrtqqjqcm.exe

Filesize
11KB

MD5
cd88b3c711e087e5f2527adddb19902f

SHA1
21a979133fb8ba30d08a0e5d20f5d0bd1654d1cb

SHA256
052b01b1cbe8fbd4892ef56eff276535be106e11098de89ca3b8d96fc861e5bf

SHA512
67d872e3bdf01fdd86c49507eb96329603b0d93d32bde02f511f736308d4bec97ae1e84a2284231ed350cc02deb43c95ee3d214ffcf237601c4cfdbe848beda2

Download Submit
C:\Users\Admin\AppData\Local\Temp\parent.txt

Filesize
449KB

MD5
4ba998ebb14caf9d3abe087a55b3b170

SHA1
cc44fd5bf32dac8fdc59be33ad2d9f38f81dfc3f

SHA256
e29e1de814efcf834f84237c90abd2d2182a03be5ddad212791ded92e2bbd9af

SHA512
aefb97df4462bfbe2958f72cbcb8124afe94e02734661e2270fc5968214e11f8888bd7037d0e14f2029154ce9fffc6655b8b657c648ce30d7d0e7d36a4409ff9

Download Submit
\Users\Admin\AppData\Local\Temp\mbagfrtqqjqcm.exe

Filesize
11KB

MD5
cd88b3c711e087e5f2527adddb19902f

SHA1
21a979133fb8ba30d08a0e5d20f5d0bd1654d1cb

SHA256
052b01b1cbe8fbd4892ef56eff276535be106e11098de89ca3b8d96fc861e5bf

SHA512
67d872e3bdf01fdd86c49507eb96329603b0d93d32bde02f511f736308d4bec97ae1e84a2284231ed350cc02deb43c95ee3d214ffcf237601c4cfdbe848beda2

Download Submit
\Users\Admin\AppData\Local\Temp\mbagfrtqqjqcm.exe

Filesize
11KB

MD5
cd88b3c711e087e5f2527adddb19902f

SHA1
21a979133fb8ba30d08a0e5d20f5d0bd1654d1cb

SHA256
052b01b1cbe8fbd4892ef56eff276535be106e11098de89ca3b8d96fc861e5bf

SHA512
67d872e3bdf01fdd86c49507eb96329603b0d93d32bde02f511f736308d4bec97ae1e84a2284231ed350cc02deb43c95ee3d214ffcf237601c4cfdbe848beda2

Download Submit
\Users\Admin\AppData\Local\Temp\mbagfrtqqjqcm.exe

Filesize
11KB

MD5
cd88b3c711e087e5f2527adddb19902f

SHA1
21a979133fb8ba30d08a0e5d20f5d0bd1654d1cb

SHA256
052b01b1cbe8fbd4892ef56eff276535be106e11098de89ca3b8d96fc861e5bf

SHA512
67d872e3bdf01fdd86c49507eb96329603b0d93d32bde02f511f736308d4bec97ae1e84a2284231ed350cc02deb43c95ee3d214ffcf237601c4cfdbe848beda2

Download Submit
\Users\Admin\AppData\Local\Temp\mbagfrtqqjqcm.exe

Filesize
11KB

MD5
cd88b3c711e087e5f2527adddb19902f

SHA1
21a979133fb8ba30d08a0e5d20f5d0bd1654d1cb

SHA256
052b01b1cbe8fbd4892ef56eff276535be106e11098de89ca3b8d96fc861e5bf

SHA512
67d872e3bdf01fdd86c49507eb96329603b0d93d32bde02f511f736308d4bec97ae1e84a2284231ed350cc02deb43c95ee3d214ffcf237601c4cfdbe848beda2

Download Submit
memory/956-57-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/956-62-0x0000000074380000-0x000000007492B000-memory.dmp

Filesize
5.7MB

Download
memory/956-63-0x0000000074380000-0x000000007492B000-memory.dmp

Filesize
5.7MB

Download
memory/956-64-0x0000000000869000-0x000000000087A000-memory.dmp

Filesize
68KB

Download
memory/956-65-0x0000000000869000-0x000000000087A000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing