6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558

General

Target

6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe
Size

230KB
MD5

0acd91a009e0c96a5bf5289cc85e0640
SHA1

af660ab81cda94ff642ffad5f07cf54f7a60b322
SHA256

6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558
SHA512

f99c46265bbd83c49a026810d655e60ca5a721766cf1593698198e75525d31e5e5918f8110c500eda62d7737aed8cab3c7f1f2029d4b98bc800af8d75f11c1d6
SSDEEP

6144:/Xt/dERx5UhJABr2szc+lJ2uIMkWrYz0eU2Dy:V/CxGw2sA+L2uIpWr+CCy

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe
File created	C:\Windows\System32\drivers\etc\hosts.ics	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 2 IoCs

evasion

pid	Process
2000	taskkill.exe
1992	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	RunDll32.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe
Key deleted	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	RunDll32.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	RunDll32.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe
1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe
1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe
1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe
1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe
1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe
1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe
1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe
1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe
1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2000	taskkill.exe
Token: SeDebugPrivilege	1992	taskkill.exe
Token: 33	1556	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1556	AUDIODG.EXE
Token: 33	1556	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1556	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe
468	RunDll32.exe
1868	RunDll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe
1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe
1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2000	1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe	26
PID 1976 wrote to memory of 2000	1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe	26
PID 1976 wrote to memory of 2000	1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe	26
PID 1976 wrote to memory of 2000	1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe	26
PID 1976 wrote to memory of 468	1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe	30
PID 1976 wrote to memory of 468	1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe	30
PID 1976 wrote to memory of 468	1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe	30
PID 1976 wrote to memory of 468	1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe	30
PID 1976 wrote to memory of 468	1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe	30
PID 1976 wrote to memory of 468	1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe	30
PID 1976 wrote to memory of 468	1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe	30
PID 1976 wrote to memory of 1868	1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe	32
PID 1976 wrote to memory of 1868	1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe	32
PID 1976 wrote to memory of 1868	1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe	32
PID 1976 wrote to memory of 1868	1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe	32
PID 1976 wrote to memory of 1868	1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe	32
PID 1976 wrote to memory of 1868	1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe	32
PID 1976 wrote to memory of 1868	1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe	32
PID 1976 wrote to memory of 1992	1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe	34
PID 1976 wrote to memory of 1992	1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe	34
PID 1976 wrote to memory of 1992	1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe	34
PID 1976 wrote to memory of 1992	1976	6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe	34

C:\Users\Admin\AppData\Local\Temp\6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe
"C:\Users\Admin\AppData\Local\Temp\6ff537a3f07e544ee74de319a43d68536fce15809e4b45cc7848c1a1e7a7c558.exe"
1⤵
- Drops file in Drivers directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im lsas.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2000
- C:\Windows\SysWOW64\RunDll32.exe
  RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  PID:468
- C:\Windows\SysWOW64\RunDll32.exe
  RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  PID:1868
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im lsas.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1992

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x480
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/468-62-0x0000000071AD1000-0x0000000071AD3000-memory.dmp

Filesize
8KB

Download
memory/1976-57-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download
memory/1976-64-0x0000000003CA0000-0x0000000004D02000-memory.dmp

Filesize
16.4MB

Download

Analysis

Sharing