abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602

General

Target

abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe
Size

4.3MB
MD5

0dd5c578a05200ba8858b9ee2f91fc18
SHA1

2b72d2b4dd4d0ff857b621c67fa3dd2fbc3c0779
SHA256

abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602
SHA512

5f36fd08b7636f7024e823603f2aa5000c33b6d5df9921bbf7f1cdf35d8f554577db5e5a61f779ee1ad30cecaed940912b3c95f3e0499f6c74e1c3a245241bc7
SSDEEP

98304:OT0vrr3UdqZwChyo1eaTkIVi4/+NbVQEMTpT9kk1UCqqM6yrQh:DrqvnocaTk3u+xsFT9kkaD60Qh

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Messenger = "\"C:\\ProgramData\\Dropbox.exe\""	abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe

description	pid	process	target process
PID 2028 set thread context of 992	2028	abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe	abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe

pid process

2028 abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe

pid	process
2028	abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe

pid	process
992	abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe
992	abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe

description	pid	process	target process
PID 2028 wrote to memory of 992	2028	abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe	abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe
PID 2028 wrote to memory of 992	2028	abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe	abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe
PID 2028 wrote to memory of 992	2028	abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe	abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe
PID 2028 wrote to memory of 992	2028	abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe	abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe
PID 2028 wrote to memory of 992	2028	abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe	abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe
PID 2028 wrote to memory of 992	2028	abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe	abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnabledLUA = "0"	abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe

C:\Users\Admin\AppData\Local\Temp\abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe
"C:\Users\Admin\AppData\Local\Temp\abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2028

C:\Users\Admin\AppData\Local\Temp\abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe
"C:\Users\Admin\AppData\Local\Temp\abe2da2c662687a10e8c7a80cfd878412733b276c0d7132657e46aba35ff4602.exe"
2⤵
- UAC bypass
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/992-57-0x0000000000C70000-0x0000000001299000-memory.dmp

Filesize
6.2MB

Download
memory/992-59-0x0000000000C70000-0x0000000001299000-memory.dmp

Filesize
6.2MB

Download
memory/992-60-0x0000000000EBE2F8-mapping.dmp

Download
memory/992-61-0x0000000000C70000-0x0000000001299000-memory.dmp

Filesize
6.2MB

Download
memory/992-63-0x0000000000C70000-0x0000000001299000-memory.dmp

Filesize
6.2MB

Download
memory/992-64-0x0000000000C70000-0x0000000001299000-memory.dmp

Filesize
6.2MB

Download
memory/992-65-0x0000000000C70000-0x0000000001299000-memory.dmp

Filesize
6.2MB

Download
memory/2028-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/2028-55-0x0000000000340000-0x000000000034B000-memory.dmp

Filesize
44KB

Download
memory/2028-56-0x0000000000350000-0x0000000000359000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads