f0cce9d174183860a9f4f92f3f430761031fb5b2b0b72b3d18a07f63fd6ba931

General

Target

f0cce9d174183860a9f4f92f3f430761031fb5b2b0b72b3d18a07f63fd6ba931.exe
Size

148KB
MD5

43680b9c54dbf17d559bd7fa802c9924
SHA1

83f122790781c762ce81ebc7f8aa1ff27574e761
SHA256

f0cce9d174183860a9f4f92f3f430761031fb5b2b0b72b3d18a07f63fd6ba931
SHA512

e3109270de7ee4fce9aac90b95d80b3b54147ac81c0e68a0d160201d8da122aaa69eada8625d44c6e63d3bdc450e3d2de8c5e33240deaf2ab5d61c896dc044f6
SSDEEP

3072:4SeZqFzxgwMylAUR6UQUcJPPB5RPXsS+t9jiL4oQZiEAdClv:4qFzxgZVU49xEtlcWnx

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

f0cce9d174183860a9f4f92f3f430761031fb5b2b0b72b3d18a07f63fd6ba931.exemdsiex.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	f0cce9d174183860a9f4f92f3f430761031fb5b2b0b72b3d18a07f63fd6ba931.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	mdsiex.exe

Executes dropped EXE 1 IoCs

Processes:

mdsiex.exe

pid process

1908 mdsiex.exe

pid	process
1908	mdsiex.exe

Loads dropped DLL 2 IoCs

Processes:

f0cce9d174183860a9f4f92f3f430761031fb5b2b0b72b3d18a07f63fd6ba931.exe

pid	process
1820	f0cce9d174183860a9f4f92f3f430761031fb5b2b0b72b3d18a07f63fd6ba931.exe
1820	f0cce9d174183860a9f4f92f3f430761031fb5b2b0b72b3d18a07f63fd6ba931.exe

Adds Run key to start application 2 TTPs 46 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

mdsiex.exef0cce9d174183860a9f4f92f3f430761031fb5b2b0b72b3d18a07f63fd6ba931.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /B"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /Z"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /k"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /d"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /H"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /W"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /T"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /r"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /s"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /V"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /q"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /S"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /j"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /R"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /Q"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /X"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /b"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /z"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /E"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /f"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /b"	f0cce9d174183860a9f4f92f3f430761031fb5b2b0b72b3d18a07f63fd6ba931.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /l"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /a"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /N"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /O"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /h"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /w"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /M"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /e"	mdsiex.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\	f0cce9d174183860a9f4f92f3f430761031fb5b2b0b72b3d18a07f63fd6ba931.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /c"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /t"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /C"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /u"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /v"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /Y"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /P"	mdsiex.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /m"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /L"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /o"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /i"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /F"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /n"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /y"	mdsiex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdsiex = "C:\\Users\\Admin\\mdsiex.exe /I"	mdsiex.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

f0cce9d174183860a9f4f92f3f430761031fb5b2b0b72b3d18a07f63fd6ba931.exemdsiex.exe

pid	process
1820	f0cce9d174183860a9f4f92f3f430761031fb5b2b0b72b3d18a07f63fd6ba931.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe
1908	mdsiex.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

f0cce9d174183860a9f4f92f3f430761031fb5b2b0b72b3d18a07f63fd6ba931.exemdsiex.exe

pid process

1820 f0cce9d174183860a9f4f92f3f430761031fb5b2b0b72b3d18a07f63fd6ba931.exe
1908 mdsiex.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

f0cce9d174183860a9f4f92f3f430761031fb5b2b0b72b3d18a07f63fd6ba931.exe

description	pid	process	target process
PID 1820 wrote to memory of 1908	1820	f0cce9d174183860a9f4f92f3f430761031fb5b2b0b72b3d18a07f63fd6ba931.exe	mdsiex.exe
PID 1820 wrote to memory of 1908	1820	f0cce9d174183860a9f4f92f3f430761031fb5b2b0b72b3d18a07f63fd6ba931.exe	mdsiex.exe
PID 1820 wrote to memory of 1908	1820	f0cce9d174183860a9f4f92f3f430761031fb5b2b0b72b3d18a07f63fd6ba931.exe	mdsiex.exe
PID 1820 wrote to memory of 1908	1820	f0cce9d174183860a9f4f92f3f430761031fb5b2b0b72b3d18a07f63fd6ba931.exe	mdsiex.exe

C:\Users\Admin\AppData\Local\Temp\f0cce9d174183860a9f4f92f3f430761031fb5b2b0b72b3d18a07f63fd6ba931.exe
"C:\Users\Admin\AppData\Local\Temp\f0cce9d174183860a9f4f92f3f430761031fb5b2b0b72b3d18a07f63fd6ba931.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820

C:\Users\Admin\mdsiex.exe
"C:\Users\Admin\mdsiex.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\mdsiex.exe

Filesize
148KB

MD5
fc028efb5a9b38b5f39ab6378713b737

SHA1
b99f0aa7a858eecf3b28288d0e89c1df6a05fe2c

SHA256
243cba3e80ad5601c780d4110ee60b2d173a734ad0716bc03ec5647a4305ef1a

SHA512
466e85f320f55051859e7a53f7ed7094bcf62e37f7a9cb374c269fc2a8ee164f8d9ad2f56ac106389ca73902954f605159531db2180bf9b83766bb9fbe9f730a

Download Submit
C:\Users\Admin\mdsiex.exe

Filesize
148KB

MD5
fc028efb5a9b38b5f39ab6378713b737

SHA1
b99f0aa7a858eecf3b28288d0e89c1df6a05fe2c

SHA256
243cba3e80ad5601c780d4110ee60b2d173a734ad0716bc03ec5647a4305ef1a

SHA512
466e85f320f55051859e7a53f7ed7094bcf62e37f7a9cb374c269fc2a8ee164f8d9ad2f56ac106389ca73902954f605159531db2180bf9b83766bb9fbe9f730a

Download Submit
\Users\Admin\mdsiex.exe

Filesize
148KB

MD5
fc028efb5a9b38b5f39ab6378713b737

SHA1
b99f0aa7a858eecf3b28288d0e89c1df6a05fe2c

SHA256
243cba3e80ad5601c780d4110ee60b2d173a734ad0716bc03ec5647a4305ef1a

SHA512
466e85f320f55051859e7a53f7ed7094bcf62e37f7a9cb374c269fc2a8ee164f8d9ad2f56ac106389ca73902954f605159531db2180bf9b83766bb9fbe9f730a

Download Submit
\Users\Admin\mdsiex.exe

Filesize
148KB

MD5
fc028efb5a9b38b5f39ab6378713b737

SHA1
b99f0aa7a858eecf3b28288d0e89c1df6a05fe2c

SHA256
243cba3e80ad5601c780d4110ee60b2d173a734ad0716bc03ec5647a4305ef1a

SHA512
466e85f320f55051859e7a53f7ed7094bcf62e37f7a9cb374c269fc2a8ee164f8d9ad2f56ac106389ca73902954f605159531db2180bf9b83766bb9fbe9f730a

Download Submit
memory/1820-56-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1820-58-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1820-57-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/1820-66-0x0000000002E60000-0x0000000002E85000-memory.dmp

Filesize
148KB

Download
memory/1820-67-0x0000000002E60000-0x0000000002E85000-memory.dmp

Filesize
148KB

Download
memory/1820-70-0x0000000002E60000-0x0000000002E85000-memory.dmp

Filesize
148KB

Download
memory/1820-71-0x0000000002E60000-0x0000000002E85000-memory.dmp

Filesize
148KB

Download
memory/1908-61-0x0000000000000000-mapping.dmp

Download
memory/1908-68-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1908-72-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads