1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60

General

Target

1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe
Size

1.2MB
MD5

60a8027168b5aa8423ec37e8fc4abc67
SHA1

f8652e8c9743cf6fc5270536958f294d5057141f
SHA256

1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60
SHA512

037b1f689fcbb43d62219f820623d573c5965c0798758e1167b453fd1eb2894f856d825558e499f0ac7c5893edd66026cbb14936974f8170261920622a1d5d1a
SSDEEP

24576:XRmJkqoQrilOIQ+yMxGaddZ4FF4F4GpoEktcc5XDQvaLF40:8JXoQryTiMxGaddOFF4F4G5ktl5ZH

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\iexplore = "C:\\Users\\Admin\\AppData\\Roaming\\iexplore.exe"	1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe

description	pid	process	target process
PID 1564 set thread context of 848	1564	1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe	1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe

pid	process
1564	1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe
1564	1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe
1564	1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe

pid	process
1564	1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe
1564	1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe
1564	1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe

description	pid	process	target process
PID 1564 wrote to memory of 848	1564	1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe	1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe
PID 1564 wrote to memory of 848	1564	1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe	1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe
PID 1564 wrote to memory of 848	1564	1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe	1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe
PID 1564 wrote to memory of 848	1564	1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe	1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe
PID 1564 wrote to memory of 848	1564	1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe	1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe
PID 1564 wrote to memory of 848	1564	1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe	1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe
PID 1564 wrote to memory of 848	1564	1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe	1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe
PID 1564 wrote to memory of 848	1564	1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe	1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe
PID 1564 wrote to memory of 848	1564	1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe	1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe
PID 1564 wrote to memory of 848	1564	1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe	1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe
PID 1564 wrote to memory of 848	1564	1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe	1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe

C:\Users\Admin\AppData\Local\Temp\1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe
"C:\Users\Admin\AppData\Local\Temp\1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Users\Admin\AppData\Local\Temp\1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe
  "C:\Users\Admin\AppData\Local\Temp\1301bda2767be74eefa9c2e26078f8f643d32350e011bc46630e68389239ff60.exe"
  2⤵
  - Adds Run key to start application
  PID:848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/848-63-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/848-55-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/848-56-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/848-58-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/848-60-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/848-62-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/848-65-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/848-67-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/848-68-0x000000000045BE9C-mapping.dmp

Download
memory/848-71-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/848-69-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/848-72-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1564-54-0x00000000766F1000-0x00000000766F3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads