62895e4b8963035e1d4bf2dd0733c84a63fb76196105edbd6b37f33b101c9202

General

Target

62895e4b8963035e1d4bf2dd0733c84a63fb76196105edbd6b37f33b101c9202.exe
Size

137KB
MD5

4f561486c4a8bda8acdc2edbc2d84e30
SHA1

e23918de3c54b8515bd6f6ae974b5bc1e00f8588
SHA256

62895e4b8963035e1d4bf2dd0733c84a63fb76196105edbd6b37f33b101c9202
SHA512

08f72b8fb0980e610bd910001663aa9f04fbcf22f984f7ee09cadfeaef3acae090c708ba817fd240802c42bdde01fbefd4081bca58e6a76c6a82efcaf978bafd
SSDEEP

3072:xp6FfBpfGCAKH7z9rrMcIENFTSGXwjxPuejNhNuO4:/6dBZGCAKbzx3foGXwU82

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winver.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\3BCFB654 = "C:\\Users\\Admin\\AppData\\Roaming\\3BCFB654\\bin.exe"	winver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\3BCFB654 = "C:\\Users\\Admin\\AppData\\Roaming\\3BCFB654\\bin.exe"	winver.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

winver.exe

pid	process
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe
1676	winver.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1200 Explorer.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Explorer.EXE

description pid process

Token: SeShutdownPrivilege 1200 Explorer.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

winver.exe

pid process

1676 winver.exe

pid	process
1200	Explorer.EXE

description	pid	process
Token: SeShutdownPrivilege	1200	Explorer.EXE

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

62895e4b8963035e1d4bf2dd0733c84a63fb76196105edbd6b37f33b101c9202.exewinver.exe

description	pid	process	target process
PID 1908 wrote to memory of 1676	1908	62895e4b8963035e1d4bf2dd0733c84a63fb76196105edbd6b37f33b101c9202.exe	winver.exe
PID 1908 wrote to memory of 1676	1908	62895e4b8963035e1d4bf2dd0733c84a63fb76196105edbd6b37f33b101c9202.exe	winver.exe
PID 1908 wrote to memory of 1676	1908	62895e4b8963035e1d4bf2dd0733c84a63fb76196105edbd6b37f33b101c9202.exe	winver.exe
PID 1908 wrote to memory of 1676	1908	62895e4b8963035e1d4bf2dd0733c84a63fb76196105edbd6b37f33b101c9202.exe	winver.exe
PID 1908 wrote to memory of 1676	1908	62895e4b8963035e1d4bf2dd0733c84a63fb76196105edbd6b37f33b101c9202.exe	winver.exe
PID 1676 wrote to memory of 1200	1676	winver.exe	Explorer.EXE
PID 1676 wrote to memory of 1120	1676	winver.exe	taskhost.exe
PID 1676 wrote to memory of 1164	1676	winver.exe	Dwm.exe
PID 1676 wrote to memory of 1200	1676	winver.exe	Explorer.EXE
PID 1676 wrote to memory of 1908	1676	winver.exe	62895e4b8963035e1d4bf2dd0733c84a63fb76196105edbd6b37f33b101c9202.exe

C:\Users\Admin\AppData\Local\Temp\62895e4b8963035e1d4bf2dd0733c84a63fb76196105edbd6b37f33b101c9202.exe
"C:\Users\Admin\AppData\Local\Temp\62895e4b8963035e1d4bf2dd0733c84a63fb76196105edbd6b37f33b101c9202.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1908

C:\Windows\SysWOW64\winver.exe
winver
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1200

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1164

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1120

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1120-73-0x0000000001E60000-0x0000000001E69000-memory.dmp

Filesize
36KB

Download
memory/1200-59-0x00000000026B0000-0x00000000026B9000-memory.dmp

Filesize
36KB

Download
memory/1200-74-0x00000000026C0000-0x00000000026C9000-memory.dmp

Filesize
36KB

Download
memory/1200-71-0x00000000026B0000-0x00000000026B9000-memory.dmp

Filesize
36KB

Download
memory/1676-57-0x0000000000000000-mapping.dmp

Download
memory/1676-70-0x00000000000D0000-0x00000000000D9000-memory.dmp

Filesize
36KB

Download
memory/1676-72-0x0000000077D80000-0x0000000077F00000-memory.dmp

Filesize
1.5MB

Download
memory/1908-69-0x0000000002D50000-0x0000000003750000-memory.dmp

Filesize
10.0MB

Download
memory/1908-54-0x00000000767D1000-0x00000000767D3000-memory.dmp

Filesize
8KB

Download
memory/1908-56-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1908-55-0x0000000002750000-0x00000000027E5000-memory.dmp

Filesize
596KB

Download
memory/1908-75-0x0000000000050000-0x0000000000066000-memory.dmp

Filesize
88KB

Download
memory/1908-76-0x0000000077D80000-0x0000000077F00000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads