db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a

General

Target

db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe
Size

196KB
MD5

0d5ed7c8e96cc9a9f28fddbb31ae31ef
SHA1

0d1764ef7093c0872ddb31a1bbf6baf9ee873d70
SHA256

db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a
SHA512

a672c4858968afc5676670879736c620c557ef663bdd0087b46521507e9dc79d8fde17dfb872c67b820c87daeccec1c5ddfc35afe3405b5bdc78c19977f14737
SSDEEP

6144:kK1D59kajqFnyzSgcedwXOOqYGzP/0KF:q1A4eMfqfP/

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe:*:Enabled:Distributed Transaction Coordinator"	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe

Executes dropped EXE 1 IoCs

Processes:

msdtc.exe

pid process

2752 msdtc.exe

pid	process
2752	msdtc.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Distributed Transaction Coordinator = "C:\\Users\\Admin\\AppData\\Roaming\\msdtc.exe"	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exemsdtc.exe

pid	process
2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe
2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe
2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe
2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe
2752	msdtc.exe
2752	msdtc.exe
2752	msdtc.exe
2752	msdtc.exe
2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe
2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe
2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe
2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe
2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe
2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe
2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe
2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe
2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe
2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe

pid process

2956 db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exemsdtc.exe

description	pid	process	target process
PID 2956 wrote to memory of 2740	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	Explorer.EXE
PID 2956 wrote to memory of 2740	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	Explorer.EXE
PID 2956 wrote to memory of 2740	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	Explorer.EXE
PID 2956 wrote to memory of 2404	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	sihost.exe
PID 2956 wrote to memory of 2404	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	sihost.exe
PID 2956 wrote to memory of 2404	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	sihost.exe
PID 2956 wrote to memory of 2432	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	svchost.exe
PID 2956 wrote to memory of 2432	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	svchost.exe
PID 2956 wrote to memory of 2432	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	svchost.exe
PID 2956 wrote to memory of 2588	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	taskhostw.exe
PID 2956 wrote to memory of 2588	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	taskhostw.exe
PID 2956 wrote to memory of 2588	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	taskhostw.exe
PID 2956 wrote to memory of 2740	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	Explorer.EXE
PID 2956 wrote to memory of 2740	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	Explorer.EXE
PID 2956 wrote to memory of 2740	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	Explorer.EXE
PID 2956 wrote to memory of 2648	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	svchost.exe
PID 2956 wrote to memory of 2648	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	svchost.exe
PID 2956 wrote to memory of 2648	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	svchost.exe
PID 2956 wrote to memory of 3252	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	DllHost.exe
PID 2956 wrote to memory of 3252	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	DllHost.exe
PID 2956 wrote to memory of 3252	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	DllHost.exe
PID 2956 wrote to memory of 3344	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	StartMenuExperienceHost.exe
PID 2956 wrote to memory of 3344	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	StartMenuExperienceHost.exe
PID 2956 wrote to memory of 3344	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	StartMenuExperienceHost.exe
PID 2956 wrote to memory of 3420	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	RuntimeBroker.exe
PID 2956 wrote to memory of 3420	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	RuntimeBroker.exe
PID 2956 wrote to memory of 3420	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	RuntimeBroker.exe
PID 2956 wrote to memory of 3504	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	SearchApp.exe
PID 2956 wrote to memory of 3504	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	SearchApp.exe
PID 2956 wrote to memory of 3504	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	SearchApp.exe
PID 2956 wrote to memory of 3704	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	RuntimeBroker.exe
PID 2956 wrote to memory of 3704	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	RuntimeBroker.exe
PID 2956 wrote to memory of 3704	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	RuntimeBroker.exe
PID 2956 wrote to memory of 4608	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	RuntimeBroker.exe
PID 2956 wrote to memory of 4608	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	RuntimeBroker.exe
PID 2956 wrote to memory of 4608	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	RuntimeBroker.exe
PID 2956 wrote to memory of 2752	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	msdtc.exe
PID 2956 wrote to memory of 2752	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	msdtc.exe
PID 2956 wrote to memory of 2752	2956	db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe	msdtc.exe
PID 2752 wrote to memory of 2740	2752	msdtc.exe	Explorer.EXE
PID 2752 wrote to memory of 2740	2752	msdtc.exe	Explorer.EXE
PID 2752 wrote to memory of 2740	2752	msdtc.exe	Explorer.EXE
PID 2752 wrote to memory of 2404	2752	msdtc.exe	sihost.exe
PID 2752 wrote to memory of 2404	2752	msdtc.exe	sihost.exe
PID 2752 wrote to memory of 2404	2752	msdtc.exe	sihost.exe
PID 2752 wrote to memory of 2432	2752	msdtc.exe	svchost.exe
PID 2752 wrote to memory of 2432	2752	msdtc.exe	svchost.exe
PID 2752 wrote to memory of 2432	2752	msdtc.exe	svchost.exe
PID 2752 wrote to memory of 2588	2752	msdtc.exe	taskhostw.exe
PID 2752 wrote to memory of 2588	2752	msdtc.exe	taskhostw.exe
PID 2752 wrote to memory of 2588	2752	msdtc.exe	taskhostw.exe
PID 2752 wrote to memory of 2740	2752	msdtc.exe	Explorer.EXE
PID 2752 wrote to memory of 2740	2752	msdtc.exe	Explorer.EXE
PID 2752 wrote to memory of 2740	2752	msdtc.exe	Explorer.EXE
PID 2752 wrote to memory of 2648	2752	msdtc.exe	svchost.exe
PID 2752 wrote to memory of 2648	2752	msdtc.exe	svchost.exe
PID 2752 wrote to memory of 2648	2752	msdtc.exe	svchost.exe
PID 2752 wrote to memory of 3252	2752	msdtc.exe	DllHost.exe
PID 2752 wrote to memory of 3252	2752	msdtc.exe	DllHost.exe
PID 2752 wrote to memory of 3252	2752	msdtc.exe	DllHost.exe
PID 2752 wrote to memory of 3344	2752	msdtc.exe	StartMenuExperienceHost.exe
PID 2752 wrote to memory of 3344	2752	msdtc.exe	StartMenuExperienceHost.exe
PID 2752 wrote to memory of 3344	2752	msdtc.exe	StartMenuExperienceHost.exe
PID 2752 wrote to memory of 3420	2752	msdtc.exe	RuntimeBroker.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2432

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2588

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4608

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3704

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3504

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3420

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3344

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2648

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2740
- C:\Users\Admin\AppData\Local\Temp\db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe
  "C:\Users\Admin\AppData\Local\Temp\db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a.exe"
  2⤵
  - Modifies firewall policy service
  - Checks computer location settings
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Users\Admin\AppData\Roaming\msdtc.exe
    "C:\Users\Admin\AppData\Roaming\msdtc.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\msdtc.exe

Filesize
196KB

MD5
0d5ed7c8e96cc9a9f28fddbb31ae31ef

SHA1
0d1764ef7093c0872ddb31a1bbf6baf9ee873d70

SHA256
db1d98c16820f551f859b02d4fff9fe9611a35760e0a3fbb6e5e24843093503a

SHA512
a672c4858968afc5676670879736c620c557ef663bdd0087b46521507e9dc79d8fde17dfb872c67b820c87daeccec1c5ddfc35afe3405b5bdc78c19977f14737

Download Submit
memory/2740-132-0x000000007FFC0000-0x000000007FFD1000-memory.dmp

Filesize
68KB

Download
memory/2740-133-0x000000007FF80000-0x000000007FFB1000-memory.dmp

Filesize
196KB

Download
memory/2752-161-0x0000000000000000-mapping.dmp

Download
memory/2752-170-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2956-158-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2956-159-0x000000007FDF0000-0x000000007FE01000-memory.dmp

Filesize
68KB

Download
memory/2956-160-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/2956-192-0x000000007FD70000-0x000000007FD81000-memory.dmp

Filesize
68KB

Download
memory/2956-193-0x000000007FD10000-0x000000007FD1C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads