a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0

General

Target

a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe
Size

110KB
MD5

263c4ff75d3326332d8726973b438dce
SHA1

5428f37be9496e116824942365f1e858532add63
SHA256

a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0
SHA512

3e5126f60c7cdaad1835fe7bbd75c270ba5ce80fa2b86ec90afa2bb05cae7f3323bec0df444f4b8234570e9a63fe6da1907bd6e570e4ded8fa7cbe9b3dd0e970
SSDEEP

1536:gHZJpUtSkvNYa1zLQezA/i4g/JWVR/Yps6LaUIYgCcyvBZYwL3iQogA6Td2:gBUtSkvNYaLRi1QsItZLH

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe

Executes dropped EXE 1 IoCs

Processes:

conima.exe

pid process

1728 conima.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

992 cmd.exe

pid	process
1728	conima.exe

pid	process
992	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe

pid	process
2028	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe
2028	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exeRundll32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Input Manager = "C:\\Users\\Admin\\AppData\\Local\\conima.exe"	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	Rundll32.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe

Drops file in Windows directory 1 IoCs

Processes:

Rundll32.exe

description ioc process

File opened for modification C:\Windows\INF\setupapi.app.log Rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.app.log	Rundll32.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

runonce.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

Processes:

a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.execonima.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "yes"	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes"	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Error Dlg Displayed On Every Error = "no"	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	conima.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Use FormSuggest = "yes"	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Use FormSuggest = "yes"	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1601 = "0"	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

Rundll32.exe

description	pid	process
Token: SeRestorePrivilege	900	Rundll32.exe
Token: SeRestorePrivilege	900	Rundll32.exe
Token: SeRestorePrivilege	900	Rundll32.exe
Token: SeRestorePrivilege	900	Rundll32.exe
Token: SeRestorePrivilege	900	Rundll32.exe
Token: SeRestorePrivilege	900	Rundll32.exe
Token: SeRestorePrivilege	900	Rundll32.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.execonima.exe

pid	process
2028	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe
2028	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe
2028	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe
1728	conima.exe
1728	conima.exe
1728	conima.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exeRundll32.exerunonce.exe

description	pid	process	target process
PID 2028 wrote to memory of 900	2028	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe	Rundll32.exe
PID 2028 wrote to memory of 900	2028	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe	Rundll32.exe
PID 2028 wrote to memory of 900	2028	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe	Rundll32.exe
PID 2028 wrote to memory of 900	2028	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe	Rundll32.exe
PID 2028 wrote to memory of 900	2028	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe	Rundll32.exe
PID 2028 wrote to memory of 900	2028	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe	Rundll32.exe
PID 2028 wrote to memory of 900	2028	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe	Rundll32.exe
PID 2028 wrote to memory of 1728	2028	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe	conima.exe
PID 2028 wrote to memory of 1728	2028	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe	conima.exe
PID 2028 wrote to memory of 1728	2028	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe	conima.exe
PID 2028 wrote to memory of 1728	2028	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe	conima.exe
PID 2028 wrote to memory of 992	2028	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe	cmd.exe
PID 2028 wrote to memory of 992	2028	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe	cmd.exe
PID 2028 wrote to memory of 992	2028	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe	cmd.exe
PID 2028 wrote to memory of 992	2028	a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe	cmd.exe
PID 900 wrote to memory of 1632	900	Rundll32.exe	runonce.exe
PID 900 wrote to memory of 1632	900	Rundll32.exe	runonce.exe
PID 900 wrote to memory of 1632	900	Rundll32.exe	runonce.exe
PID 900 wrote to memory of 1632	900	Rundll32.exe	runonce.exe
PID 1632 wrote to memory of 656	1632	runonce.exe	grpconv.exe
PID 1632 wrote to memory of 656	1632	runonce.exe	grpconv.exe
PID 1632 wrote to memory of 656	1632	runonce.exe	grpconv.exe
PID 1632 wrote to memory of 656	1632	runonce.exe	grpconv.exe

C:\Users\Admin\AppData\Local\Temp\a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe
"C:\Users\Admin\AppData\Local\Temp\a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\SysWOW64\Rundll32.exe
Rundll32.exe setupapi,InstallHinfSection DefaultInstall 128 C:\Users\Admin\AppData\Local\hujksrtjr.inf
2⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\SysWOW64\runonce.exe
"C:\Windows\system32\runonce.exe" -r
3⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\grpconv.exe
"C:\Windows\System32\grpconv.exe" -o
4⤵
PID:656

C:\Users\Admin\AppData\Local\conima.exe
C:\Users\Admin\AppData\Local\conima.exe -sysrun
2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1728

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\WQOwZqm4.bat
2⤵
- Deletes itself
PID:992

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1

T1158

Modify Registry

3

T1112

Credential Access

Discovery

System Information Discovery

3

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WQOwZqm4.bat
Filesize
254B

MD5
7558009fda60fdc3cd956197342f3064

SHA1
1f3dbc558aefb182e7893a1f4ff71c1b0c1f3620

SHA256
4e334f2b09f3fdf73d6c40e52023261f29464e16de24f5f36228aae42f1a2460

SHA512
e245035381941a421cc2ad31b3b987201c9cf2041343194f7bf462140f6feb92b647d04a27881a481616f9de04a0ea957772c02bbbec5307c9b07c13f61fc2f8

Download Submit
C:\Users\Admin\AppData\Local\conima.exe
Filesize
110KB

MD5
263c4ff75d3326332d8726973b438dce

SHA1
5428f37be9496e116824942365f1e858532add63

SHA256
a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0

SHA512
3e5126f60c7cdaad1835fe7bbd75c270ba5ce80fa2b86ec90afa2bb05cae7f3323bec0df444f4b8234570e9a63fe6da1907bd6e570e4ded8fa7cbe9b3dd0e970

Download Submit
C:\Users\Admin\AppData\Local\conima.exe
Filesize
110KB

MD5
263c4ff75d3326332d8726973b438dce

SHA1
5428f37be9496e116824942365f1e858532add63

SHA256
a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0

SHA512
3e5126f60c7cdaad1835fe7bbd75c270ba5ce80fa2b86ec90afa2bb05cae7f3323bec0df444f4b8234570e9a63fe6da1907bd6e570e4ded8fa7cbe9b3dd0e970

Download Submit
C:\Users\Admin\AppData\Local\hujksrtjr.inf
Filesize
384B

MD5
a3007fea94fbfe818a9d97387a8dae8c

SHA1
782a426aa85aaf2780ccdee49b9ae1925911fb9f

SHA256
9bc9d908791e7a22a737a258e29e11d353548c69fe5c914b5919fe84ec1c80c3

SHA512
6c66cbc72ec8c5a30cc9aea812210963139ea7cfeedd0f36222d5017350a738d129c6c327215d979f448d093f06e0bf4b24a0fa80aaf9e75a56e434028610b75

Download Submit
\Users\Admin\AppData\Local\conima.exe
Filesize
110KB

MD5
263c4ff75d3326332d8726973b438dce

SHA1
5428f37be9496e116824942365f1e858532add63

SHA256
a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0

SHA512
3e5126f60c7cdaad1835fe7bbd75c270ba5ce80fa2b86ec90afa2bb05cae7f3323bec0df444f4b8234570e9a63fe6da1907bd6e570e4ded8fa7cbe9b3dd0e970

Download Submit
\Users\Admin\AppData\Local\conima.exe
Filesize
110KB

MD5
263c4ff75d3326332d8726973b438dce

SHA1
5428f37be9496e116824942365f1e858532add63

SHA256
a9ec894d386d83f0e650b89dbaa2709c45542631cb570f6244ed37d6cc96c0d0

SHA512
3e5126f60c7cdaad1835fe7bbd75c270ba5ce80fa2b86ec90afa2bb05cae7f3323bec0df444f4b8234570e9a63fe6da1907bd6e570e4ded8fa7cbe9b3dd0e970

Download Submit
memory/656-79-0x0000000000000000-mapping.dmp

Download
memory/900-59-0x0000000000000000-mapping.dmp

Download
memory/992-73-0x0000000000000000-mapping.dmp

Download
memory/1632-77-0x0000000000000000-mapping.dmp

Download
memory/1728-69-0x00000000029D0000-0x0000000003A32000-memory.dmp

Filesize
16.4MB

Download
memory/1728-72-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1728-64-0x0000000000000000-mapping.dmp

Download
memory/1728-81-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2028-71-0x0000000006DE0000-0x0000000006E00000-memory.dmp

Filesize
128KB

Download
memory/2028-70-0x0000000006DE0000-0x0000000006E00000-memory.dmp

Filesize
128KB

Download
memory/2028-57-0x00000000026A0000-0x0000000003702000-memory.dmp

Filesize
16.4MB

Download
memory/2028-56-0x0000000075A31000-0x0000000075A33000-memory.dmp

Filesize
8KB

Download
memory/2028-58-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2028-76-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads