abf1dedf51410cc805c55cfb829292cf89bcaa6e7ff6c9cb982c95dbd87c2362

General

Target

abf1dedf51410cc805c55cfb829292cf89bcaa6e7ff6c9cb982c95dbd87c2362.exe
Size

517KB
MD5

4033419dbc5330452f1cad3c58277105
SHA1

f2a0f795654158ce785f3977ce72ffb0d06e158a
SHA256

abf1dedf51410cc805c55cfb829292cf89bcaa6e7ff6c9cb982c95dbd87c2362
SHA512

a633699a28a5619a377b434002a7ab44b6328e9ee90e2000d8634f5ce3bbeb959327f81e5fbf36e2951661041c3d47739bee7cb2546ad43d398278575e317fa2
SSDEEP

12288:AmUqR5z0FOTC1NXIHfpJYlY/Qy5eEG30LC+MCW1qrQpPt/0KuV:AmUqqOTAXIHfpOcQ6JG30L/MCW1yQpiB

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

abf1dedf51410cc805c55cfb829292cf89bcaa6e7ff6c9cb982c95dbd87c2362.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ abf1dedf51410cc805c55cfb829292cf89bcaa6e7ff6c9cb982c95dbd87c2362.exe
Executes dropped EXE 1 IoCs

Processes:

s9647.exe

pid process

2436 s9647.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	abf1dedf51410cc805c55cfb829292cf89bcaa6e7ff6c9cb982c95dbd87c2362.exe

pid	process
2436	s9647.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

abf1dedf51410cc805c55cfb829292cf89bcaa6e7ff6c9cb982c95dbd87c2362.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	abf1dedf51410cc805c55cfb829292cf89bcaa6e7ff6c9cb982c95dbd87c2362.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

s9647.exe

description ioc process

File created C:\Windows\assembly\Desktop.ini s9647.exe
File opened for modification C:\Windows\assembly\Desktop.ini s9647.exe

description	ioc	process
File created	C:\Windows\assembly\Desktop.ini	s9647.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	s9647.exe

Drops file in Windows directory 3 IoCs

Processes:

s9647.exe

description	ioc	process
File opened for modification	C:\Windows\assembly	s9647.exe
File created	C:\Windows\assembly\Desktop.ini	s9647.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	s9647.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3680 2544 WerFault.exe abf1dedf51410cc805c55cfb829292cf89bcaa6e7ff6c9cb982c95dbd87c2362.exe

pid	pid_target	process	target process
3680	2544	WerFault.exe	abf1dedf51410cc805c55cfb829292cf89bcaa6e7ff6c9cb982c95dbd87c2362.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

abf1dedf51410cc805c55cfb829292cf89bcaa6e7ff6c9cb982c95dbd87c2362.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	abf1dedf51410cc805c55cfb829292cf89bcaa6e7ff6c9cb982c95dbd87c2362.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	abf1dedf51410cc805c55cfb829292cf89bcaa6e7ff6c9cb982c95dbd87c2362.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

abf1dedf51410cc805c55cfb829292cf89bcaa6e7ff6c9cb982c95dbd87c2362.exes9647.exe

pid	process
2544	abf1dedf51410cc805c55cfb829292cf89bcaa6e7ff6c9cb982c95dbd87c2362.exe
2544	abf1dedf51410cc805c55cfb829292cf89bcaa6e7ff6c9cb982c95dbd87c2362.exe
2436	s9647.exe
2436	s9647.exe
2436	s9647.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

s9647.exe

description pid process

Token: SeDebugPrivilege 2436 s9647.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

s9647.exe

pid process

2436 s9647.exe
2436 s9647.exe

description	pid	process
Token: SeDebugPrivilege	2436	s9647.exe

pid	process
2436	s9647.exe
2436	s9647.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

abf1dedf51410cc805c55cfb829292cf89bcaa6e7ff6c9cb982c95dbd87c2362.exe

description	pid	process	target process
PID 2544 wrote to memory of 2436	2544	abf1dedf51410cc805c55cfb829292cf89bcaa6e7ff6c9cb982c95dbd87c2362.exe	s9647.exe
PID 2544 wrote to memory of 2436	2544	abf1dedf51410cc805c55cfb829292cf89bcaa6e7ff6c9cb982c95dbd87c2362.exe	s9647.exe

C:\Users\Admin\AppData\Local\Temp\abf1dedf51410cc805c55cfb829292cf89bcaa6e7ff6c9cb982c95dbd87c2362.exe
"C:\Users\Admin\AppData\Local\Temp\abf1dedf51410cc805c55cfb829292cf89bcaa6e7ff6c9cb982c95dbd87c2362.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks computer location settings
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2544

C:\Users\Admin\AppData\Local\Temp\n9647\s9647.exe
"C:\Users\Admin\AppData\Local\Temp\n9647\s9647.exe" ins.exe /e 13029947 /u 8765b7a1-1326-11e4-8a58-80c16e6f498c /h ef64a6.api.socdn.com /v "C:\Users\Admin\AppData\Local\Temp\abf1dedf51410cc805c55cfb829292cf89bcaa6e7ff6c9cb982c95dbd87c2362.exe"
2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 3776
2⤵
- Program crash
PID:3680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2544 -ip 2544
1⤵
PID:2708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

3

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\n9647\s9647.exe

Filesize
339KB

MD5
0e88682aeba4d7ef923b316f97f990ba

SHA1
a54a0df52206ab79c0ad19be7402ab8564b7ad8c

SHA256
6be0358b2703e0e317ec4ddefbc320014b3c2a14eb1d959b0ed399586fd2bba1

SHA512
c0755f0b6fd5d01872464c1fa4b3d11c4ad4fd84f355bc9a9938bc5057373c18753915eeaabd31eb1db5cd95399a5b5083de31f11b55adba58316082421607c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\n9647\s9647.exe

Filesize
339KB

MD5
0e88682aeba4d7ef923b316f97f990ba

SHA1
a54a0df52206ab79c0ad19be7402ab8564b7ad8c

SHA256
6be0358b2703e0e317ec4ddefbc320014b3c2a14eb1d959b0ed399586fd2bba1

SHA512
c0755f0b6fd5d01872464c1fa4b3d11c4ad4fd84f355bc9a9938bc5057373c18753915eeaabd31eb1db5cd95399a5b5083de31f11b55adba58316082421607c6

Download Submit
memory/2436-132-0x0000000000000000-mapping.dmp

Download
memory/2436-135-0x00007FF8A3AE0000-0x00007FF8A4516000-memory.dmp

Filesize
10.2MB

Download
memory/2436-136-0x0000000000A0A000-0x0000000000A0F000-memory.dmp

Filesize
20KB

Download
memory/2436-137-0x0000000000A0A000-0x0000000000A0F000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads