52d00acb16cd0ace3299cf0316737c7984e235957e83a6369d0f4d16f70598a9

General

Target

52d00acb16cd0ace3299cf0316737c7984e235957e83a6369d0f4d16f70598a9.exe
Size

806KB
MD5

3a16a6be9ce2c8c3a36e6a5046defe20
SHA1

eaeb585bd7cb1366f830b09624c130196df7b0f3
SHA256

52d00acb16cd0ace3299cf0316737c7984e235957e83a6369d0f4d16f70598a9
SHA512

0ad9fdc87a07079d028e96eea2300305df75e048d344b3691bcf02a7efa06c406a574e058f10470993a5169508f9cf7c4841b931df234faef12513426dc54b73
SSDEEP

12288:8gDhdkq5BCoC5LfWSLTUQpr2Zu19QmrM9Q:8gDhdkMRWfLTUO2Zu1umrMS

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe scvshosts.exe"	52d00acb16cd0ace3299cf0316737c7984e235957e83a6369d0f4d16f70598a9.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	52d00acb16cd0ace3299cf0316737c7984e235957e83a6369d0f4d16f70598a9.exe

Disables Task Manager via registry modification
evasion

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run	52d00acb16cd0ace3299cf0316737c7984e235957e83a6369d0f4d16f70598a9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Windows\\system32\\scvshosts.exe"	52d00acb16cd0ace3299cf0316737c7984e235957e83a6369d0f4d16f70598a9.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/4732-132-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/4732-137-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\blastclnnn.exe	52d00acb16cd0ace3299cf0316737c7984e235957e83a6369d0f4d16f70598a9.exe
File opened for modification	C:\Windows\SysWOW64\blastclnnn.exe	52d00acb16cd0ace3299cf0316737c7984e235957e83a6369d0f4d16f70598a9.exe
File opened for modification	C:\Windows\SysWOW64\autorun.ini	52d00acb16cd0ace3299cf0316737c7984e235957e83a6369d0f4d16f70598a9.exe
File created	C:\Windows\SysWOW64\setting.ini	52d00acb16cd0ace3299cf0316737c7984e235957e83a6369d0f4d16f70598a9.exe
File created	C:\Windows\SysWOW64\scvshosts.exe	52d00acb16cd0ace3299cf0316737c7984e235957e83a6369d0f4d16f70598a9.exe
File opened for modification	C:\Windows\SysWOW64\scvshosts.exe	52d00acb16cd0ace3299cf0316737c7984e235957e83a6369d0f4d16f70598a9.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\hinhem.scr	52d00acb16cd0ace3299cf0316737c7984e235957e83a6369d0f4d16f70598a9.exe
File created	C:\Windows\scvshosts.exe	52d00acb16cd0ace3299cf0316737c7984e235957e83a6369d0f4d16f70598a9.exe
File opened for modification	C:\Windows\scvshosts.exe	52d00acb16cd0ace3299cf0316737c7984e235957e83a6369d0f4d16f70598a9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 3424	4732	52d00acb16cd0ace3299cf0316737c7984e235957e83a6369d0f4d16f70598a9.exe	83
PID 4732 wrote to memory of 3424	4732	52d00acb16cd0ace3299cf0316737c7984e235957e83a6369d0f4d16f70598a9.exe	83
PID 4732 wrote to memory of 3424	4732	52d00acb16cd0ace3299cf0316737c7984e235957e83a6369d0f4d16f70598a9.exe	83
PID 3424 wrote to memory of 4448	3424	cmd.exe	85
PID 3424 wrote to memory of 4448	3424	cmd.exe	85
PID 3424 wrote to memory of 4448	3424	cmd.exe	85
PID 4732 wrote to memory of 4168	4732	52d00acb16cd0ace3299cf0316737c7984e235957e83a6369d0f4d16f70598a9.exe	86
PID 4732 wrote to memory of 4168	4732	52d00acb16cd0ace3299cf0316737c7984e235957e83a6369d0f4d16f70598a9.exe	86
PID 4732 wrote to memory of 4168	4732	52d00acb16cd0ace3299cf0316737c7984e235957e83a6369d0f4d16f70598a9.exe	86
PID 4168 wrote to memory of 380	4168	cmd.exe	88
PID 4168 wrote to memory of 380	4168	cmd.exe	88
PID 4168 wrote to memory of 380	4168	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\52d00acb16cd0ace3299cf0316737c7984e235957e83a6369d0f4d16f70598a9.exe
"C:\Users\Admin\AppData\Local\Temp\52d00acb16cd0ace3299cf0316737c7984e235957e83a6369d0f4d16f70598a9.exe"
1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT /delete /yes
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Windows\SysWOW64\at.exe
    AT /delete /yes
    3⤵
    PID:4448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\blastclnnn.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\SysWOW64\at.exe
    AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\blastclnnn.exe
    3⤵
    PID:380

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/380-136-0x0000000000000000-mapping.dmp

Download
memory/3424-133-0x0000000000000000-mapping.dmp

Download
memory/4168-135-0x0000000000000000-mapping.dmp

Download
memory/4448-134-0x0000000000000000-mapping.dmp

Download
memory/4732-132-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/4732-137-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads