cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516

General

Target

cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516.exe
Size

292KB
MD5

84134e81eed0e7a6bff2ebafaa9f1080
SHA1

5b1d41b4d8404cb578942b7e44e3a43e145f0153
SHA256

cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516
SHA512

0b65aefb7ab9b88378e414b86ce7bd0742a4941ca007417c2863892505935816dec481011481522b040419fd18ede729d242eaa3a0766fbe681f6e60b1d0cc30
SSDEEP

6144:DVNxf01ziLoxnFVBIKbxIW6ZBk27xxl9C6Ya:hNxf01zikxn+KbxibB7xf9v

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Active Setup\Installed Components\{TA0OLHFE-VLK3-V5PH-OVQ1-B2PAOO54P9G2}	cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Active Setup\Installed Components\{TA0OLHFE-VLK3-V5PH-OVQ1-B2PAOO54P9G2}\StubPath = "C:\\Windows\\system32\\myclient.exe"	cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{TA0OLHFE-VLK3-V5PH-OVQ1-B2PAOO54P9G2}	cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{TA0OLHFE-VLK3-V5PH-OVQ1-B2PAOO54P9G2}\StubPath = "C:\\Windows\\system32\\myclient.exe"	cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tJedcyVzACBs = "C:\\Windows\\system32\\myclient.exe"	cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kf3pn4 = "C:\\Windows\\system32\\myclient.exe"	cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\myclient.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\myclient.exe	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1816 set thread context of 832	1816	cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516.exe	27

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1816	cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 832	1816	cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516.exe	27
PID 1816 wrote to memory of 832	1816	cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516.exe	27
PID 1816 wrote to memory of 832	1816	cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516.exe	27
PID 1816 wrote to memory of 832	1816	cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516.exe	27
PID 1816 wrote to memory of 832	1816	cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516.exe	27
PID 1816 wrote to memory of 832	1816	cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516.exe	27
PID 1816 wrote to memory of 832	1816	cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516.exe	27
PID 1816 wrote to memory of 832	1816	cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516.exe	27
PID 1816 wrote to memory of 832	1816	cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516.exe	27
PID 1816 wrote to memory of 832	1816	cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516.exe	27
PID 832 wrote to memory of 1400	832	cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516.exe	19
PID 832 wrote to memory of 1400	832	cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516.exe	19
PID 1816 wrote to memory of 1640	1816	cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516.exe	28
PID 1816 wrote to memory of 1640	1816	cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516.exe	28
PID 1816 wrote to memory of 1640	1816	cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516.exe	28
PID 1816 wrote to memory of 1640	1816	cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516.exe	28

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1400
- C:\Users\Admin\AppData\Local\Temp\cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516.exe
  "C:\Users\Admin\AppData\Local\Temp\cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516.exe"
  2⤵
  - Modifies Installed Components in the registry
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Users\Admin\AppData\Local\Temp\cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516.exe
    C:\Users\Admin\AppData\Local\Temp\cfbb106b583c0893c602fb4e578172f69a712db9fb31c0ef5baa4cc9d9967516.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:832
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\T11mB8BwvO.bat" "
    3⤵
    - Drops file in System32 directory
    PID:1640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\T11mB8BwvO.bat

Filesize
219B

MD5
7ae9821f39166375ed7ee4b08783ea97

SHA1
f78aa8c3f7eff97fb505d7529b19f4ae8c222a0a

SHA256
762092c9772b60d170daff263b7fbdbb8fa6519f782fe6f0d11ed1b291d44696

SHA512
7d97fe11023c26bdda93b62038be918df9bc7bf5722aebee8e1ec07835a93efe0974936c3493e3051aabcd22f0d4609b81d7d205057f764a9eee5efc3d870126

Download Submit
memory/832-73-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/832-68-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/832-60-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/832-62-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/832-64-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/832-65-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/832-58-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/832-57-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/832-66-0x00000000004013D8-mapping.dmp

Download
memory/1400-70-0x0000000002560000-0x000000000256D000-memory.dmp

Filesize
52KB

Download
memory/1400-72-0x0000000002560000-0x000000000256D000-memory.dmp

Filesize
52KB

Download
memory/1640-74-0x0000000000000000-mapping.dmp

Download
memory/1816-56-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1816-76-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1816-69-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads