13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c

General

Target

13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
Size

178KB
MD5

0b62db064492dbaded5dd07fc9a508d0
SHA1

c7a8c3cb25aa63fc304cca8f30c780a0427e8e8b
SHA256

13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c
SHA512

e222eabbd621f263b6745f1498dc011d75bfd7686979fa5477b031c6546aa9df22d6e0ba93ba02de43858812e1bcf9b3d4d63f6e77e25eb4b01a2d8a949e843a
SSDEEP

3072:I7VNBmjq8Kmvn6rIVTYC7H2rAalUW4R6rv3p8WStxlQu2VCPwc:I7VzxYnWI6agAalr4UrPp8WStPQu285

Score

8^/10

evasion persistence

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

1576 attrib.exe

pid	process
1576	attrib.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

REG.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 17 IoCs

Remote System Discovery

T1018

Processes:

ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exe

pid	process
1068	ping.exe
916	ping.exe
1296	ping.exe
580	ping.exe
1976	ping.exe
1840	ping.exe
2012	ping.exe
640	ping.exe
1120	ping.exe
1592	ping.exe
1476	ping.exe
1680	ping.exe
868	ping.exe
676	ping.exe
1628	ping.exe
1108	ping.exe
2032	ping.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe

description pid process

Token: SeDebugPrivilege 1608 13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe

description	pid	process
Token: SeDebugPrivilege	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe

description	pid	process	target process
PID 1608 wrote to memory of 1976	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1976	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1976	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1976	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1068	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1068	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1068	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1068	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 916	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 916	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 916	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 916	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1840	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1840	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1840	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1840	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 640	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 640	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 640	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 640	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1296	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1296	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1296	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1296	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 2012	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 2012	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 2012	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 2012	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 676	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 676	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 676	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 676	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1628	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1628	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1628	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1628	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1120	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1120	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1120	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1120	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1576	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	attrib.exe
PID 1608 wrote to memory of 1576	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	attrib.exe
PID 1608 wrote to memory of 1576	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	attrib.exe
PID 1608 wrote to memory of 1576	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	attrib.exe
PID 1608 wrote to memory of 1544	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	REG.exe
PID 1608 wrote to memory of 1544	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	REG.exe
PID 1608 wrote to memory of 1544	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	REG.exe
PID 1608 wrote to memory of 1544	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	REG.exe
PID 1608 wrote to memory of 1592	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1592	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1592	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1592	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1476	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1476	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1476	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1476	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1108	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1108	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1108	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 1108	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 580	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 580	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 580	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 1608 wrote to memory of 580	1608	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

1576 attrib.exe

pid	process
1576	attrib.exe

C:\Users\Admin\AppData\Local\Temp\13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
"C:\Users\Admin\AppData\Local\Temp\13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1608

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:1976

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:1068

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:916

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:1840

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:640

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:1296

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:2012

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:676

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:1628

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:1120

C:\Windows\SysWOW64\attrib.exe
"C:\Windows\System32\attrib.exe" +s +h C:\Users\Admin\AppData\Local\Temp\13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
2⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1576

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
2⤵
- Adds Run key to start application
PID:1544

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:1592

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:1476

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:1108

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:580

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:1680

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:2032

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:868

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

2

T1158

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/580-72-0x0000000000000000-mapping.dmp

Download
memory/640-61-0x0000000000000000-mapping.dmp

Download
memory/676-64-0x0000000000000000-mapping.dmp

Download
memory/868-75-0x0000000000000000-mapping.dmp

Download
memory/916-59-0x0000000000000000-mapping.dmp

Download
memory/1068-58-0x0000000000000000-mapping.dmp

Download
memory/1108-71-0x0000000000000000-mapping.dmp

Download
memory/1120-66-0x0000000000000000-mapping.dmp

Download
memory/1296-62-0x0000000000000000-mapping.dmp

Download
memory/1476-70-0x0000000000000000-mapping.dmp

Download
memory/1544-68-0x0000000000000000-mapping.dmp

Download
memory/1576-67-0x0000000000000000-mapping.dmp

Download
memory/1592-69-0x0000000000000000-mapping.dmp

Download
memory/1608-54-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download
memory/1608-56-0x00000000744E0000-0x0000000074A8B000-memory.dmp

Filesize
5.7MB

Download
memory/1608-55-0x00000000744E0000-0x0000000074A8B000-memory.dmp

Filesize
5.7MB

Download
memory/1628-65-0x0000000000000000-mapping.dmp

Download
memory/1680-73-0x0000000000000000-mapping.dmp

Download
memory/1840-60-0x0000000000000000-mapping.dmp

Download
memory/1976-57-0x0000000000000000-mapping.dmp

Download
memory/2012-63-0x0000000000000000-mapping.dmp

Download
memory/2032-74-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads