ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114

General

Target

ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe
Size

189KB
MD5

81e6923300e501779f1fdfd86e91894e
SHA1

0ca470457064e30d345b470eff4187267a4dd449
SHA256

ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114
SHA512

9589750a6a4875f1e4f067841223d647a09d85461b1f9e6313bb808441a5d5d7c7c55389df96344f4292f50fae1052dfe777915dfd86a6513a30559ac37283f0
SSDEEP

3072:QIWGC7W7BuDcYzI1eqgKJ+BCOcPsbsWNMBHnX65fj7K7ymCwOQH4PWvI40EKX1cb:eGC7W7BUagKaasbsWNMVn4fj2ymTOQHP

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe

pid process

240 ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe

pid	process
240	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe

description	pid	process	target process
PID 240 set thread context of 1500	240	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe

pid	process
1500	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe
1500	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe
1500	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe
1500	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe

pid process

240 ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe

pid	process
240	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe

description	pid	process	target process
PID 240 wrote to memory of 1500	240	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe
PID 240 wrote to memory of 1500	240	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe
PID 240 wrote to memory of 1500	240	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe
PID 240 wrote to memory of 1500	240	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe
PID 240 wrote to memory of 1500	240	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe

C:\Users\Admin\AppData\Local\Temp\ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe
"C:\Users\Admin\AppData\Local\Temp\ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:240

C:\Users\Admin\AppData\Local\Temp\ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe
"C:\Users\Admin\AppData\Local\Temp\ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:1500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsoF421.tmp\System.dll

Filesize
11KB

MD5
3e6bf00b3ac976122f982ae2aadb1c51

SHA1
caab188f7fdc84d3fdcb2922edeeb5ed576bd31d

SHA256
4ff9b2678d698677c5d9732678f9cf53f17290e09d053691aac4cc6e6f595cbe

SHA512
1286f05e6a7e6b691f6e479638e7179897598e171b52eb3a3dc0e830415251069d29416b6d1ffc6d7dce8da5625e1479be06db9b7179e7776659c5c1ad6aa706

Download Submit
memory/240-54-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/240-56-0x00000000003A0000-0x00000000003B2000-memory.dmp

Filesize
72KB

Download
memory/240-58-0x00000000003A0000-0x00000000003B2000-memory.dmp

Filesize
72KB

Download
memory/1500-57-0x00000000001C1E76-mapping.dmp

Download
memory/1500-60-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/1500-64-0x00000000001C0000-0x00000000001CF000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads