3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5

General

Target

3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe
Size

228KB
MD5

d3577c4e72d6b51813f2b1caa33ee41e
SHA1

488d3129732aed8ddff2642c3c087e3a4938d836
SHA256

3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5
SHA512

0dbe841c3b830a0e82f278bae04fd4ea71b6e9a49588514d1bde0c4e5b17e83d36250f01a7138fe0f49632943aa5de1ada229fc2c1cc609b69bbe1c5acbd9ee1
SSDEEP

3072:zKPIMPYbAlsrJ7KL0NerZBqe3i7zdKUXXYMdVZS6rrtOh63MFOydj:zMYbAlMFOs7zdjldVZSMWdFO

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

SystemControlS.exe

pid process

1868 SystemControlS.exe
Loads dropped DLL 1 IoCs

Processes:

3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe

pid process

1720 3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe

pid	process
1868	SystemControlS.exe

pid	process
1720	3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exeSystemControlS.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Autumn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe"	3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Autumn = "C:\\Users\\Admin\\AppData\\Roaming\\Founder Systems\\SystemControlS.exe"	SystemControlS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe

pid process

1720 3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe

description pid process

Token: SeDebugPrivilege 1720 3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe

pid	process
1720	3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe

description	pid	process
Token: SeDebugPrivilege	1720	3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe

description	pid	process	target process
PID 1720 wrote to memory of 1868	1720	3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe	SystemControlS.exe
PID 1720 wrote to memory of 1868	1720	3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe	SystemControlS.exe
PID 1720 wrote to memory of 1868	1720	3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe	SystemControlS.exe
PID 1720 wrote to memory of 1868	1720	3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe	SystemControlS.exe

C:\Users\Admin\AppData\Local\Temp\3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe
"C:\Users\Admin\AppData\Local\Temp\3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720

C:\Users\Admin\AppData\Roaming\Founder Systems\SystemControlS.exe
"C:\Users\Admin\AppData\Roaming\Founder Systems\SystemControlS.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1868

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Founder Systems\SystemControlS.exe
Filesize
221KB

MD5
003582bac5429ce527bb975fecf32779

SHA1
f3f593e58154e68bc5c3acf1b157c309d357f541

SHA256
8409fb981e144fedf99a6955d9e28a5feeb9094b4b8fae5914ef2ed862ec9c46

SHA512
a29cff19d4408614897f6164db9e84bc1c630e9f29c7b0e1663e4560ab9080db3b3d475ad7d6f4d3661a98b50be1a39b3090bda6f6ba4e459547bbdc54644ad3

Download Submit
C:\Users\Admin\AppData\Roaming\Founder Systems\SystemControlS.exe
Filesize
221KB

MD5
003582bac5429ce527bb975fecf32779

SHA1
f3f593e58154e68bc5c3acf1b157c309d357f541

SHA256
8409fb981e144fedf99a6955d9e28a5feeb9094b4b8fae5914ef2ed862ec9c46

SHA512
a29cff19d4408614897f6164db9e84bc1c630e9f29c7b0e1663e4560ab9080db3b3d475ad7d6f4d3661a98b50be1a39b3090bda6f6ba4e459547bbdc54644ad3

Download Submit
\Users\Admin\AppData\Roaming\Founder Systems\SystemControlS.exe
Filesize
221KB

MD5
003582bac5429ce527bb975fecf32779

SHA1
f3f593e58154e68bc5c3acf1b157c309d357f541

SHA256
8409fb981e144fedf99a6955d9e28a5feeb9094b4b8fae5914ef2ed862ec9c46

SHA512
a29cff19d4408614897f6164db9e84bc1c630e9f29c7b0e1663e4560ab9080db3b3d475ad7d6f4d3661a98b50be1a39b3090bda6f6ba4e459547bbdc54644ad3

Download Submit
memory/1720-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/1720-59-0x00000000749D0000-0x0000000074F7B000-memory.dmp

Filesize
5.7MB

Download
memory/1868-56-0x0000000000000000-mapping.dmp

Download
memory/1868-60-0x000007FEF4650000-0x000007FEF5073000-memory.dmp

Filesize
10.1MB

Download

Analysis

Sharing