aa1a5fe4cf72064f807965e8c96d19e96053afecadd9a08fb30be9459b1957d4

General

Target
aa1a5fe4cf72064f807965e8c96d19e96053afecadd9a08fb30be9459b1957d4.exe
Size 104KB
Sample221020-j7z2msddb8
SHA256 aa1a5fe4cf72064f807965e8c96d19e96053afecadd9a08fb30be9459b1957d4
MD5 8198d8dc131827b5b7951c1343b717d0
SHA1 9b813f1312a7b13681cb2b7726a7feb0a4945ca2
SHA512 fc6a8ad80b7c84f456e4ab04ea42bc030bb4d18f1f7ab4a980aa19e2a62c0a40badfa5865bd596dfa8fc36f84f796c8a0b66cf6b091fb710554432d35472afd8
SSDEEP 3072:BpU9efV3zItskAes8pxxHBZujgZTOlcdy:E98V3zItxxRuUZThQ
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4912	q8jtjEw0.exe
4136	q8jtjEw0.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	aa1a5fe4cf72064f807965e8c96d19e96053afecadd9a08fb30be9459b1957d4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	aa1a5fe4cf72064f807965e8c96d19e96053afecadd9a08fb30be9459b1957d4.exe

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	109.230.217.44
Destination IP	109.230.217.44
Destination IP	109.230.217.44
Destination IP	109.230.217.44

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	q8jtjEw0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	aa1a5fe4cf72064f807965e8c96d19e96053afecadd9a08fb30be9459b1957d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	q8jtjEw0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	aa1a5fe4cf72064f807965e8c96d19e96053afecadd9a08fb30be9459b1957d4.exe

Modifies Internet Explorer Protected Mode Banner 1 TTPs 4 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	aa1a5fe4cf72064f807965e8c96d19e96053afecadd9a08fb30be9459b1957d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	q8jtjEw0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	aa1a5fe4cf72064f807965e8c96d19e96053afecadd9a08fb30be9459b1957d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	q8jtjEw0.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes"	q8jtjEw0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Error Dlg Displayed On Every Error = "no"	q8jtjEw0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes"	aa1a5fe4cf72064f807965e8c96d19e96053afecadd9a08fb30be9459b1957d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Error Dlg Displayed On Every Error = "no"	aa1a5fe4cf72064f807965e8c96d19e96053afecadd9a08fb30be9459b1957d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes"	q8jtjEw0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Error Dlg Displayed On Every Error = "no"	q8jtjEw0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes"	aa1a5fe4cf72064f807965e8c96d19e96053afecadd9a08fb30be9459b1957d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Error Dlg Displayed On Every Error = "no"	aa1a5fe4cf72064f807965e8c96d19e96053afecadd9a08fb30be9459b1957d4.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1168	aa1a5fe4cf72064f807965e8c96d19e96053afecadd9a08fb30be9459b1957d4.exe
1168	aa1a5fe4cf72064f807965e8c96d19e96053afecadd9a08fb30be9459b1957d4.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 4912	1168	aa1a5fe4cf72064f807965e8c96d19e96053afecadd9a08fb30be9459b1957d4.exe	81
PID 1168 wrote to memory of 4912	1168	aa1a5fe4cf72064f807965e8c96d19e96053afecadd9a08fb30be9459b1957d4.exe	81
PID 1168 wrote to memory of 4912	1168	aa1a5fe4cf72064f807965e8c96d19e96053afecadd9a08fb30be9459b1957d4.exe	81
PID 1168 wrote to memory of 3928	1168	aa1a5fe4cf72064f807965e8c96d19e96053afecadd9a08fb30be9459b1957d4.exe	84
PID 1168 wrote to memory of 3928	1168	aa1a5fe4cf72064f807965e8c96d19e96053afecadd9a08fb30be9459b1957d4.exe	84
PID 1168 wrote to memory of 3928	1168	aa1a5fe4cf72064f807965e8c96d19e96053afecadd9a08fb30be9459b1957d4.exe	84
PID 3928 wrote to memory of 4136	3928	aa1a5fe4cf72064f807965e8c96d19e96053afecadd9a08fb30be9459b1957d4.exe	85
PID 3928 wrote to memory of 4136	3928	aa1a5fe4cf72064f807965e8c96d19e96053afecadd9a08fb30be9459b1957d4.exe	85
PID 3928 wrote to memory of 4136	3928	aa1a5fe4cf72064f807965e8c96d19e96053afecadd9a08fb30be9459b1957d4.exe	85

C:\Users\Admin\AppData\Local\Temp\aa1a5fe4cf72064f807965e8c96d19e96053afecadd9a08fb30be9459b1957d4.exe
"C:\Users\Admin\AppData\Local\Temp\aa1a5fe4cf72064f807965e8c96d19e96053afecadd9a08fb30be9459b1957d4.exe"
1⤵
- Checks computer location settings
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1168
- C:\ProgramData\q8jtjEw0.exe
  "C:\ProgramData\q8jtjEw0.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer Protected Mode
  - Modifies Internet Explorer Protected Mode Banner
  - Modifies Internet Explorer settings
  PID:4912
- C:\Users\Admin\AppData\Local\Temp\aa1a5fe4cf72064f807965e8c96d19e96053afecadd9a08fb30be9459b1957d4.exe
  "C:\Users\Admin\AppData\Local\Temp\aa1a5fe4cf72064f807965e8c96d19e96053afecadd9a08fb30be9459b1957d4.exe"
  2⤵
  - Checks computer location settings
  - Modifies Internet Explorer Protected Mode
  - Modifies Internet Explorer Protected Mode Banner
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3928
- - C:\ProgramData\q8jtjEw0.exe
    "C:\ProgramData\q8jtjEw0.exe"
    3⤵
    - Executes dropped EXE
    - Modifies Internet Explorer Protected Mode
    - Modifies Internet Explorer Protected Mode Banner
    - Modifies Internet Explorer settings
    PID:4136

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

q8jtjEw0.exe

Path C:\ProgramData\q8jtjEw0.exe
Size 104KB
SHA256 aa1a5fe4cf72064f807965e8c96d19e96053afecadd9a08fb30be9459b1957d4
MD5 8198d8dc131827b5b7951c1343b717d0
SHA1 9b813f1312a7b13681cb2b7726a7feb0a4945ca2
SHA512 fc6a8ad80b7c84f456e4ab04ea42bc030bb4d18f1f7ab4a980aa19e2a62c0a40badfa5865bd596dfa8fc36f84f796c8a0b66cf6b091fb710554432d35472afd8
SSDEEP 3072:BpU9efV3zItskAes8pxxHBZujgZTOlcdy:E98V3zItxxRuUZThQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

q8jtjEw0.exe

Path C:\ProgramData\q8jtjEw0.exe
Size 104KB
SHA256 aa1a5fe4cf72064f807965e8c96d19e96053afecadd9a08fb30be9459b1957d4
MD5 8198d8dc131827b5b7951c1343b717d0
SHA1 9b813f1312a7b13681cb2b7726a7feb0a4945ca2
SHA512 fc6a8ad80b7c84f456e4ab04ea42bc030bb4d18f1f7ab4a980aa19e2a62c0a40badfa5865bd596dfa8fc36f84f796c8a0b66cf6b091fb710554432d35472afd8
SSDEEP 3072:BpU9efV3zItskAes8pxxHBZujgZTOlcdy:E98V3zItxxRuUZThQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

q8jtjEw0.exe

Path C:\ProgramData\q8jtjEw0.exe
Size 104KB
SHA256 aa1a5fe4cf72064f807965e8c96d19e96053afecadd9a08fb30be9459b1957d4
MD5 8198d8dc131827b5b7951c1343b717d0
SHA1 9b813f1312a7b13681cb2b7726a7feb0a4945ca2
SHA512 fc6a8ad80b7c84f456e4ab04ea42bc030bb4d18f1f7ab4a980aa19e2a62c0a40badfa5865bd596dfa8fc36f84f796c8a0b66cf6b091fb710554432d35472afd8
SSDEEP 3072:BpU9efV3zItskAes8pxxHBZujgZTOlcdy:E98V3zItxxRuUZThQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads