2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb

General

Target

2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
Size

85KB
MD5

3f731af7ec3d833439cc2dd9497b72ca
SHA1

5f6fd48d5096461a0b6d9e13a62bc8f0b7d39547
SHA256

2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb
SHA512

2bc351bc9808d5fb094eb3a5c54318c935815bc8367c921f0b384052007141db40004e4b43995c4971a21cda1de0c17dcb5dfddd8a66871ac1e0b354d514626d
SSDEEP

1536:VGLyzqIfhbp1pG7eWLX1v8W84gYWmdmsnHm7ayzSY+4JdLzFDhRnP5F:VJWTGttmLHm7DSYfBzFDhRnD

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1436-55-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/1436-57-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/1436-58-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/1436-63-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/1436-64-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/1436-65-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/1436-66-0x0000000000400000-0x0000000000416000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "c:\\users\\admin\\appdata\\local\\temp\\2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe"	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe

description	pid	process	target process
PID 844 set thread context of 1436	844	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe

pid	process
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe

pid	process
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
1436	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe

description	pid	process	target process
PID 844 wrote to memory of 1436	844	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
PID 844 wrote to memory of 1436	844	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
PID 844 wrote to memory of 1436	844	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
PID 844 wrote to memory of 1436	844	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
PID 844 wrote to memory of 1436	844	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
PID 844 wrote to memory of 1436	844	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
PID 844 wrote to memory of 1436	844	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
PID 844 wrote to memory of 1436	844	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe	2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe

C:\Users\Admin\AppData\Local\Temp\2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
"C:\Users\Admin\AppData\Local\Temp\2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:844

\??\c:\users\admin\appdata\local\temp\2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe
"c:\users\admin\appdata\local\temp\2ced938f26db6b9cb2361079650b0c9eee9ff04de7cb918029d7ddfb2ef05deb.exe"
2⤵
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/844-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1436-54-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1436-55-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1436-57-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1436-58-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1436-59-0x0000000000414200-mapping.dmp

Download
memory/1436-62-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download
memory/1436-63-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1436-64-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1436-65-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1436-66-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads