3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f

General

Target

3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
Size

350KB
MD5

0cf41fb2e1fadef7ef0f2ca81d738a14
SHA1

34e0894f542f4049dc74bb5936c7ee467308e2e5
SHA256

3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f
SHA512

af96a2c05521b0dbc47668580eb19729ec1d4a8fe6608d4d8564056ff1e7456661a06fb06928bee5ccfbb59c872ae959e686e98b84f04f3ef4b7b6cda6e8393c
SSDEEP

1536:aIqueF0GQ4DlMIR8PWkjkOwQZvBVgcNdgg6P:YBDCXPWkjkOwQxTNdgg6P

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe smrss.exe"	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe

Executes dropped EXE 1 IoCs

pid	Process
1144	32131.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\freizer = "C:\\WINDOWS\\system32\\freizer.exe"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\WINDOWS\\system32\\svchost.exe"	reg.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\smrss.exe	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
File opened for modification	C:\Windows\SysWOW64\smrss.exe	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
File created	C:\WINDOWS\SysWOW64\freizer.exe	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\svchost.exe	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1952	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
1952	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
1952	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
1952	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
1952	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
1952	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
1952	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
1952	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
1952	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
1952	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
1952	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
1952	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
1952	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
1952	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
1952	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
1952	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
1952	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
1952	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
1952	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
1952	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
1952	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
1952	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 5004	1952	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe	82
PID 1952 wrote to memory of 5004	1952	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe	82
PID 1952 wrote to memory of 5004	1952	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe	82
PID 1952 wrote to memory of 4988	1952	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe	83
PID 1952 wrote to memory of 4988	1952	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe	83
PID 1952 wrote to memory of 4988	1952	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe	83
PID 4988 wrote to memory of 4868	4988	cmd.exe	87
PID 4988 wrote to memory of 4868	4988	cmd.exe	87
PID 4988 wrote to memory of 4868	4988	cmd.exe	87
PID 5004 wrote to memory of 4832	5004	cmd.exe	86
PID 5004 wrote to memory of 4832	5004	cmd.exe	86
PID 5004 wrote to memory of 4832	5004	cmd.exe	86
PID 1952 wrote to memory of 1144	1952	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe	88
PID 1952 wrote to memory of 1144	1952	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe	88
PID 1952 wrote to memory of 1144	1952	3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe	88

C:\Users\Admin\AppData\Local\Temp\3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe
"C:\Users\Admin\AppData\Local\Temp\3b73a12b05cb6e16ae03944448ba4c04ff9400510627da19d6c7ac8a34b6632f.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\cmd.exe
  cmd /c reg ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v freizer /t REG_SZ /d C:\WINDOWS\system32\freizer.exe /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Windows\SysWOW64\reg.exe
    reg ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v freizer /t REG_SZ /d C:\WINDOWS\system32\freizer.exe /f
    3⤵
    - Adds Run key to start application
    PID:4832
- C:\Windows\SysWOW64\cmd.exe
  cmd /c reg ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v svchost /t REG_SZ /d C:\WINDOWS\system32\svchost.exe /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Windows\SysWOW64\reg.exe
    reg ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v svchost /t REG_SZ /d C:\WINDOWS\system32\svchost.exe /f
    3⤵
    - Adds Run key to start application
    PID:4868
- C:\windows\temp\32131.exe
  "C:\windows\temp\32131.exe"
  2⤵
  - Executes dropped EXE
  PID:1144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\32131.exe

Filesize
40KB

MD5
2eb7ee901edc9d38fe1af56998868d49

SHA1
3880d24e3e8ca942f78ae4c34c12ef45ddbfd0e0

SHA256
06a7592cf64550ff9b783b485205316f9b5a1c6d09c726ab04a3ee1975432838

SHA512
4d487f548aa58573544c45964749275b082d82ce79db93fa28e642516cff7eb4f62f759eb4a9da5d17713ac5950b7147618e069792ea3a415826e0e91cedbb8e

Download Submit
C:\windows\temp\32131.exe

Filesize
40KB

MD5
2eb7ee901edc9d38fe1af56998868d49

SHA1
3880d24e3e8ca942f78ae4c34c12ef45ddbfd0e0

SHA256
06a7592cf64550ff9b783b485205316f9b5a1c6d09c726ab04a3ee1975432838

SHA512
4d487f548aa58573544c45964749275b082d82ce79db93fa28e642516cff7eb4f62f759eb4a9da5d17713ac5950b7147618e069792ea3a415826e0e91cedbb8e

Download Submit
memory/1144-136-0x0000000000000000-mapping.dmp

Download
memory/1144-139-0x0000000073740000-0x0000000073CF1000-memory.dmp

Filesize
5.7MB

Download
memory/4832-135-0x0000000000000000-mapping.dmp

Download
memory/4868-134-0x0000000000000000-mapping.dmp

Download
memory/4988-133-0x0000000000000000-mapping.dmp

Download
memory/5004-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads