c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6

General

Target

c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
Size

591KB
MD5

37b60cf8b7bbcd562d9e3e06acf7c4a5
SHA1

0058e65c110fb0041be210e7cfc1e721f88ac866
SHA256

c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6
SHA512

5f5ff43e15b05187f430240b425851690d4ff9ae9b1ef7f0075c0d09d396ce99140de79fec8bb87feab3f482b9cdfc2f6f6e75bd3f665aa6b3b7e0127722c114
SSDEEP

6144:Z/0qTn9J4LmDuvayK1GqzhnOxyhIXbO9qsWCv0A5rcne/qXEX4KEeBSqElYt5:6qTn9umDuvavHhvsqXcwtX4KFgqElYt5

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sychost.exe"	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe

Drops file in System32 directory 2 IoCs

Processes:

c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe

description	ioc	process
File created	C:\Windows\SysWOW64\sychost.exe	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Windows\SysWOW64\sychost.exe	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe

Drops file in Program Files directory 58 IoCs

Processes:

c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe

pid	process
644	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
644	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
644	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
644	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
644	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
644	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
644	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
644	c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe

C:\Users\Admin\AppData\Local\Temp\c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe
"C:\Users\Admin\AppData\Local\Temp\c93c196735929529ad571656a7d18d8435d0f5ad8646e7d82581a782617062d6.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:644