5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d

General

Target

5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe
Size

264KB
MD5

486d59dbb37a6c13c4deb3bb11b514a0
SHA1

92780d7fabf2e5b616ed9f54882599aaee0af27d
SHA256

5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d
SHA512

1ed2b980dc6a5ccc26e4f8e81d80aa1c859d175ec087a19c967ce4a144e9addffd45249f247d8f24841253bcd7e7b44ee300c51ebbed5c7e1e4423580a91caac
SSDEEP

6144:P3ziWP8SKE1OmsTluVPHOGiaE9pCvT0wFg:PZ8SKE1OmsTluVliaxbg

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exenaaci.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	naaci.exe

Executes dropped EXE 1 IoCs

Processes:

naaci.exe

pid process

1164 naaci.exe

pid	process
1164	naaci.exe

Loads dropped DLL 2 IoCs

Processes:

5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe

pid	process
1200	5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe
1200	5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe

Adds Run key to start application 2 TTPs 53 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

naaci.exe5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /b"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /L"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /T"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /J"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /F"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /k"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /i"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /W"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /Y"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /Z"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /I"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /j"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /H"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /K"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /z"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /a"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /D"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /h"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /X"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /G"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /q"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /R"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /P"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /S"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /m"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /A"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /B"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /l"	naaci.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /Q"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /O"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /v"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /s"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /w"	naaci.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\	5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /n"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /f"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /x"	5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /p"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /U"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /u"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /N"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /E"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /r"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /c"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /g"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /V"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /o"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /t"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /e"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /M"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /y"	naaci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaci = "C:\\Users\\Admin\\naaci.exe /C"	naaci.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exenaaci.exe

pid	process
1200	5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe
1164	naaci.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exenaaci.exe

pid process

1200 5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe
1164 naaci.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe

description	pid	process	target process
PID 1200 wrote to memory of 1164	1200	5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe	naaci.exe
PID 1200 wrote to memory of 1164	1200	5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe	naaci.exe
PID 1200 wrote to memory of 1164	1200	5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe	naaci.exe
PID 1200 wrote to memory of 1164	1200	5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe	naaci.exe

C:\Users\Admin\AppData\Local\Temp\5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe
"C:\Users\Admin\AppData\Local\Temp\5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200

C:\Users\Admin\naaci.exe
"C:\Users\Admin\naaci.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1164

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1

T1158

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\naaci.exe
Filesize
264KB

MD5
115b2e12a4c866ed5fa4322b7f54b281

SHA1
4f8bc6643e16afc2d8d7c5b161bda425c29b3571

SHA256
398e1bc67b7ff43693a48e259e9cc70554f3d704e0c0bdd733cfb0e007932fec

SHA512
a57ad424fa14c4327616ea5e8d5ad656c6ad5c4888646590f8196eeeaa8da276bb926bd2a96838dfcb567681b49aab72e252fe91fbb22b8daaf7317bed6e216a

Download Submit
C:\Users\Admin\naaci.exe
Filesize
264KB

MD5
115b2e12a4c866ed5fa4322b7f54b281

SHA1
4f8bc6643e16afc2d8d7c5b161bda425c29b3571

SHA256
398e1bc67b7ff43693a48e259e9cc70554f3d704e0c0bdd733cfb0e007932fec

SHA512
a57ad424fa14c4327616ea5e8d5ad656c6ad5c4888646590f8196eeeaa8da276bb926bd2a96838dfcb567681b49aab72e252fe91fbb22b8daaf7317bed6e216a

Download Submit
\Users\Admin\naaci.exe
Filesize
264KB

MD5
115b2e12a4c866ed5fa4322b7f54b281

SHA1
4f8bc6643e16afc2d8d7c5b161bda425c29b3571

SHA256
398e1bc67b7ff43693a48e259e9cc70554f3d704e0c0bdd733cfb0e007932fec

SHA512
a57ad424fa14c4327616ea5e8d5ad656c6ad5c4888646590f8196eeeaa8da276bb926bd2a96838dfcb567681b49aab72e252fe91fbb22b8daaf7317bed6e216a

Download Submit
\Users\Admin\naaci.exe
Filesize
264KB

MD5
115b2e12a4c866ed5fa4322b7f54b281

SHA1
4f8bc6643e16afc2d8d7c5b161bda425c29b3571

SHA256
398e1bc67b7ff43693a48e259e9cc70554f3d704e0c0bdd733cfb0e007932fec

SHA512
a57ad424fa14c4327616ea5e8d5ad656c6ad5c4888646590f8196eeeaa8da276bb926bd2a96838dfcb567681b49aab72e252fe91fbb22b8daaf7317bed6e216a

Download Submit
memory/1164-59-0x0000000000000000-mapping.dmp

Download
memory/1200-56-0x0000000075C21000-0x0000000075C23000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads