7258a0e26912f41d939951cf0ec310228a677fb079058001aa64fdc5bf921873

General

Target

7258a0e26912f41d939951cf0ec310228a677fb079058001aa64fdc5bf921873.exe
Size

91KB
MD5

20dc7785df0f2f68ee77267b4f170620
SHA1

fe3aba7117d9093847b0f9e64e439ae3f376a6bc
SHA256

7258a0e26912f41d939951cf0ec310228a677fb079058001aa64fdc5bf921873
SHA512

47705fca579e80e5ab8d24562186c56c3fcad8c47d341f29b201f1610784ec0940bd63938d1a9ba5effd4fbf5687f2fa9f85d6ab6b60d40c1c4826a4acdb16fe
SSDEEP

768:tJLmlmGtKHKtK6krYLVvAfzlY7TOvvRtwIh41SF+FiLqKAYPUWPu/Yj+cE0zGhju:tEyoVviY7WnhDAFiW4PUPM+cxzGhjE2Q

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1412	resvr.exe

Deletes itself 1 IoCs

pid	Process
576	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ë®Ó¡±êÇ©ÏµÍ³.lnk	7258a0e26912f41d939951cf0ec310228a677fb079058001aa64fdc5bf921873.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ë®Ó¡±êÇ©ÏµÍ³.lnk	resvr.exe

Loads dropped DLL 3 IoCs

pid	Process
1644	7258a0e26912f41d939951cf0ec310228a677fb079058001aa64fdc5bf921873.exe
1644	7258a0e26912f41d939951cf0ec310228a677fb079058001aa64fdc5bf921873.exe
1412	resvr.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Index.dat	7258a0e26912f41d939951cf0ec310228a677fb079058001aa64fdc5bf921873.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\resvr.exe	7258a0e26912f41d939951cf0ec310228a677fb079058001aa64fdc5bf921873.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Index.dat	resvr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1772	DllHost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1412	1644	7258a0e26912f41d939951cf0ec310228a677fb079058001aa64fdc5bf921873.exe	29
PID 1644 wrote to memory of 1412	1644	7258a0e26912f41d939951cf0ec310228a677fb079058001aa64fdc5bf921873.exe	29
PID 1644 wrote to memory of 1412	1644	7258a0e26912f41d939951cf0ec310228a677fb079058001aa64fdc5bf921873.exe	29
PID 1644 wrote to memory of 1412	1644	7258a0e26912f41d939951cf0ec310228a677fb079058001aa64fdc5bf921873.exe	29
PID 1644 wrote to memory of 576	1644	7258a0e26912f41d939951cf0ec310228a677fb079058001aa64fdc5bf921873.exe	30
PID 1644 wrote to memory of 576	1644	7258a0e26912f41d939951cf0ec310228a677fb079058001aa64fdc5bf921873.exe	30
PID 1644 wrote to memory of 576	1644	7258a0e26912f41d939951cf0ec310228a677fb079058001aa64fdc5bf921873.exe	30
PID 1644 wrote to memory of 576	1644	7258a0e26912f41d939951cf0ec310228a677fb079058001aa64fdc5bf921873.exe	30

C:\Users\Admin\AppData\Local\Temp\7258a0e26912f41d939951cf0ec310228a677fb079058001aa64fdc5bf921873.exe
"C:\Users\Admin\AppData\Local\Temp\7258a0e26912f41d939951cf0ec310228a677fb079058001aa64fdc5bf921873.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Program Files (x86)\Common Files\Microsoft Shared\resvr.exe
  "C:\Program Files (x86)\Common Files\Microsoft Shared\resvr.exe"
  2⤵
  - Executes dropped EXE
  - Drops startup file
  - Loads dropped DLL
  - Drops file in Program Files directory
  PID:1412
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\X.bat" "
  2⤵
  - Deletes itself
  PID:576

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\microsoft shared\resvr.exe

Filesize
68KB

MD5
8c9e528d243caaa37bc3fb1dde6860f2

SHA1
849c8b0d7a310a06537127a0851c0c0afb56aa40

SHA256
32f97a7f0a3f6eea27b5bcd67b75cad5cb2702b449fd95efde46a1fa9beef20f

SHA512
6123b78a4db4fa18752ec94cddaec3b5d90cb806ce6ed3b2caed8a945c8c6f5d2b1ebff32a02c29368563bdc21cb564d188c8851b0132b0a5709b16d803e96b6

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\resvr.exe

Filesize
68KB

MD5
8c9e528d243caaa37bc3fb1dde6860f2

SHA1
849c8b0d7a310a06537127a0851c0c0afb56aa40

SHA256
32f97a7f0a3f6eea27b5bcd67b75cad5cb2702b449fd95efde46a1fa9beef20f

SHA512
6123b78a4db4fa18752ec94cddaec3b5d90cb806ce6ed3b2caed8a945c8c6f5d2b1ebff32a02c29368563bdc21cb564d188c8851b0132b0a5709b16d803e96b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7258a0e26912f41d939951cf0ec310228a677fb079058001aa64fdc5bf921873.jpg

Filesize
22KB

MD5
2588b8a43bff0cb2fe83d3de3ff5e7a9

SHA1
4cf96871fcd62ff4e032e6939bed595cd2d23348

SHA256
ecaf49cc3e93a44def60976ccbd7e816d78a119da633fe4a00d3a5fcfbf3395f

SHA512
940717a0df471b5c8aec466a349a8c09e940c707cd404974db78d18871da00e0343c413eae6717fa61bb51f427848c6e5a7558a5accade1da5a2ef67406d8138

Download Submit
C:\Users\Admin\AppData\Local\Temp\X.bat

Filesize
274B

MD5
78e4d2bb980b41da777e3a92947ed64a

SHA1
a9d47d4bd345f11b0541d00e32433847f324c847

SHA256
4b5a1910de3c014bca66c6b69aa5d249830f090afc23f1fea02730614dfe48bb

SHA512
00923c79a3088dab1c759656c23fc348baa977e0b25811c59c90b63932164f8a58a5b622a8f2a4c160bde3f13c33bdc4e487f95529c7893c402cce71e0324de7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ë®Ó¡±êÇ©ÏµÍ³.lnk

Filesize
2KB

MD5
e6aa9dc9d004bd068f3450499070c87f

SHA1
fb985ea1b7e747207d497f47585ffb6334d520e3

SHA256
963d8a262a1a1b7ed27ea910329cfa7a3a5c3c964a9b7183894b0341ea2edf7f

SHA512
a3b733ce76a050f8c905331d797ff076394a4dd66d16f1ef574bbe0a99010c2df979dfdd3e3af43dc10461ef3f4cbfa5b35036b3a1ec917d11dc53ccc6bb05df

Download Submit
\Program Files (x86)\Common Files\microsoft shared\resvr.exe

Filesize
68KB

MD5
8c9e528d243caaa37bc3fb1dde6860f2

SHA1
849c8b0d7a310a06537127a0851c0c0afb56aa40

SHA256
32f97a7f0a3f6eea27b5bcd67b75cad5cb2702b449fd95efde46a1fa9beef20f

SHA512
6123b78a4db4fa18752ec94cddaec3b5d90cb806ce6ed3b2caed8a945c8c6f5d2b1ebff32a02c29368563bdc21cb564d188c8851b0132b0a5709b16d803e96b6

Download Submit
\Program Files (x86)\Common Files\microsoft shared\resvr.exe

Filesize
68KB

MD5
8c9e528d243caaa37bc3fb1dde6860f2

SHA1
849c8b0d7a310a06537127a0851c0c0afb56aa40

SHA256
32f97a7f0a3f6eea27b5bcd67b75cad5cb2702b449fd95efde46a1fa9beef20f

SHA512
6123b78a4db4fa18752ec94cddaec3b5d90cb806ce6ed3b2caed8a945c8c6f5d2b1ebff32a02c29368563bdc21cb564d188c8851b0132b0a5709b16d803e96b6

Download Submit
\Program Files (x86)\Common Files\microsoft shared\resvr.exe

Filesize
68KB

MD5
8c9e528d243caaa37bc3fb1dde6860f2

SHA1
849c8b0d7a310a06537127a0851c0c0afb56aa40

SHA256
32f97a7f0a3f6eea27b5bcd67b75cad5cb2702b449fd95efde46a1fa9beef20f

SHA512
6123b78a4db4fa18752ec94cddaec3b5d90cb806ce6ed3b2caed8a945c8c6f5d2b1ebff32a02c29368563bdc21cb564d188c8851b0132b0a5709b16d803e96b6

Download Submit
memory/1412-69-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1412-70-0x0000000000470000-0x0000000000480000-memory.dmp

Filesize
64KB

Download
memory/1412-71-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1412-72-0x0000000000470000-0x0000000000480000-memory.dmp

Filesize
64KB

Download
memory/1644-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/1644-67-0x0000000002B20000-0x0000000002B35000-memory.dmp

Filesize
84KB

Download
memory/1644-56-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing