772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d

General

Target

772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
Size

40KB
MD5

7a22bbfd531b77e796eb1459d41cd806
SHA1

28819871c8ced277329f462f2283d5367548a907
SHA256

772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d
SHA512

418777d2702d0f69c857013659b3303a1cd7bea94cf03979c61e7fc7082427b9f3e11767f46f7a87ab1c87226dba29f4ea3ef7f17c2bba5f5c9f883df429a248
SSDEEP

768:BVmfIz1X61wO2J6OpY9x0dHXOHk3CCecGH9C/vc:B1z8wO2J6IY9x6w4RCsvc

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exeAdmin.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Admin.exe

Executes dropped EXE 1 IoCs

Processes:

Admin.exe

pid process

1708 Admin.exe

pid	process
1708	Admin.exe

Loads dropped DLL 2 IoCs

Processes:

772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe

pid	process
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exeAdmin.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe"	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Admin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe"	Admin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exeAdmin.exe

pid	process
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
1708	Admin.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
1708	Admin.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
1708	Admin.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
1708	Admin.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
1708	Admin.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
1708	Admin.exe
1708	Admin.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
1708	Admin.exe
1708	Admin.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
1708	Admin.exe
1708	Admin.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
1708	Admin.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
1708	Admin.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
1708	Admin.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
1708	Admin.exe
1708	Admin.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
1708	Admin.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
1708	Admin.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
1708	Admin.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
1708	Admin.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
1708	Admin.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
1708	Admin.exe
1708	Admin.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
1708	Admin.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
1708	Admin.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
1708	Admin.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
1708	Admin.exe
1708	Admin.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
1708	Admin.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
1708	Admin.exe
584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
1708	Admin.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exeAdmin.exe

pid process

584 772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
1708 Admin.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe

description	pid	process	target process
PID 584 wrote to memory of 1708	584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe	Admin.exe
PID 584 wrote to memory of 1708	584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe	Admin.exe
PID 584 wrote to memory of 1708	584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe	Admin.exe
PID 584 wrote to memory of 1708	584	772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe	Admin.exe

C:\Users\Admin\AppData\Local\Temp\772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
"C:\Users\Admin\AppData\Local\Temp\772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:584

C:\Users\Admin\Admin.exe
"C:\Users\Admin\Admin.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Admin.exe

Filesize
40KB

MD5
be515787e4acd56a4aa35b87bc2017b0

SHA1
f88fe57e8064a6de37c6e9a808594a3b13cd0ff4

SHA256
ef907811ccdb9585ceaddd77eeb109de3d3419843df46ab664b31a2a654817e0

SHA512
ecf91f4b966429a97078bac0f18cc9c666b6ea0ea47ab251519d675da1533e7d7f99bf3e164e10c030efcd722fb7dffe8c6c380d194c8842d54ea310ceafb042

Download Submit
C:\Users\Admin\Admin.exe

Filesize
40KB

MD5
be515787e4acd56a4aa35b87bc2017b0

SHA1
f88fe57e8064a6de37c6e9a808594a3b13cd0ff4

SHA256
ef907811ccdb9585ceaddd77eeb109de3d3419843df46ab664b31a2a654817e0

SHA512
ecf91f4b966429a97078bac0f18cc9c666b6ea0ea47ab251519d675da1533e7d7f99bf3e164e10c030efcd722fb7dffe8c6c380d194c8842d54ea310ceafb042

Download Submit
\Users\Admin\Admin.exe

Filesize
40KB

MD5
be515787e4acd56a4aa35b87bc2017b0

SHA1
f88fe57e8064a6de37c6e9a808594a3b13cd0ff4

SHA256
ef907811ccdb9585ceaddd77eeb109de3d3419843df46ab664b31a2a654817e0

SHA512
ecf91f4b966429a97078bac0f18cc9c666b6ea0ea47ab251519d675da1533e7d7f99bf3e164e10c030efcd722fb7dffe8c6c380d194c8842d54ea310ceafb042

Download Submit
\Users\Admin\Admin.exe

Filesize
40KB

MD5
be515787e4acd56a4aa35b87bc2017b0

SHA1
f88fe57e8064a6de37c6e9a808594a3b13cd0ff4

SHA256
ef907811ccdb9585ceaddd77eeb109de3d3419843df46ab664b31a2a654817e0

SHA512
ecf91f4b966429a97078bac0f18cc9c666b6ea0ea47ab251519d675da1533e7d7f99bf3e164e10c030efcd722fb7dffe8c6c380d194c8842d54ea310ceafb042

Download Submit
memory/584-56-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/1708-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads