f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65

General

Target

f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
Size

203KB
MD5

62579d15d6d135c6cf000d0c29c2232e
SHA1

804122f30421ba399c1eb17d928794fd51812e71
SHA256

f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65
SHA512

939c55580cd8b5068eee567ad191c0646d349146064afd4df9e68c0c9d0bd8289720149146c9316ca459a2cadfeac4d2a26d17b98e8d0716a44b4c30985e8d67
SSDEEP

3072:h4URpNUUX6z/DBXJfWLXWLBOZMlarAxp8+HQBJMnTrEH2yDlH8A2KsZdQ/vQ5mTK:h4SUjhtWyLsZUQAnWP6RbQ/v0QuG4QM

Score

8^/10

persistence

Malware Config

Signatures

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcpmowlny.exe	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcpmowlny.exe\DisableExceptionChainValidation	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

Loads dropped DLL 1 IoCs

Processes:

f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

pid process

1880 f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

pid	process
1880	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

Checks for any installed AV software in registry 1 TTPs 2 IoCs

Security Software Discovery

T1063

Processes:

f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\avast! Antivirus	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

description ioc process

File created C:\ProgramData\Nokia Adapter Engine\desktop.ini f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

description	ioc	process
File created	C:\ProgramData\Nokia Adapter Engine\desktop.ini	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

description	pid	process	target process
PID 1880 set thread context of 344	1880	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2696 4768 WerFault.exe svchost.exe

pid	pid_target	process	target process
2696	4768	WerFault.exe	svchost.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2628 schtasks.exe

pid	process
2628	schtasks.exe

Modifies registry class 6 IoCs

Processes:

f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\CLSID\{4B00F654-B54D-8E44-B61B-964D2ABF6785}\1B21042E	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\CLSID\{4B00F654-B54D-8E44-B61B-964D2ABF6785}\1B21042E\CG1\HAL = 05ee0000	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\CLSID\{4B00F654-B54D-8E44-B61B-964D2ABF6785}\1B21042E\CG1\BID = 2000080018000b00e607000014000000180008003b003700000000008b327f63	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\CLSID\{4B00F654-B54D-8E44-B61B-964D2ABF6785}\1B21042E\CG1	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\CLSID	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\CLSID\{4B00F654-B54D-8E44-B61B-964D2ABF6785}	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

pid	process
344	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
344	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

pid process

344 f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

description	pid	process
Token: SeRestorePrivilege	344	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
Token: SeBackupPrivilege	344	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
Token: SeDebugPrivilege	344	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exef8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

C:\Users\Admin\AppData\Local\Temp\f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
"C:\Users\Admin\AppData\Local\Temp\f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1880

C:\Users\Admin\AppData\Local\Temp\f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
"C:\Users\Admin\AppData\Local\Temp\f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe"
2⤵
- Sets file execution options in registry
- Checks computer location settings
- Checks for any installed AV software in registry
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:344

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /CREATE /SC ONLOGON /TN "Windows Update Check - 0x1B21042E" /TR "C:\ProgramData\Nokia Adapter Engine\tcpmowlny.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:2628

C:\Windows\SysWOW64\svchost.exe
-k NetworkService
3⤵
PID:4768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 88
4⤵
- Program crash
PID:2696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4768 -ip 4768
1⤵
PID:2008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Security Software Discovery

1

T1063

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nslD73B.tmp\actability.dll

Filesize
34KB

MD5
10692017651aaf01881c7a31a9ef5515

SHA1
b7f78dc3a3a81e646ad92fa7a2ef5fe675d9d9e1

SHA256
0fd14e6c5962242d15fba61bd0e1e8d7ce754ea6dd8c56c51719c10830f3902f

SHA512
c4bf7a408b1436b435519b7601e3f063b5f8599c86e536bcca9be4fdb4ef1ba588cedd151121ad3e2a8ef9f8b39a61c8fa373405aa55dfd013c02b77ccc5ba4b

Download Submit
memory/344-133-0x0000000000000000-mapping.dmp

Download
memory/344-134-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/344-136-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/344-138-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/344-139-0x0000000000590000-0x00000000005DB000-memory.dmp

Filesize
300KB

Download
memory/344-140-0x0000000000590000-0x00000000005DB000-memory.dmp

Filesize
300KB

Download
memory/344-141-0x00000000006E0000-0x00000000006EB000-memory.dmp

Filesize
44KB

Download
memory/344-143-0x0000000000590000-0x00000000005DB000-memory.dmp

Filesize
300KB

Download
memory/2628-142-0x0000000000000000-mapping.dmp

Download
memory/4768-144-0x0000000000000000-mapping.dmp

Download
memory/4768-145-0x0000000077A60000-0x0000000077C03000-memory.dmp

Filesize
1.6MB

Download

description	pid	process	target process
PID 1880 wrote to memory of 344	1880	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
PID 1880 wrote to memory of 344	1880	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
PID 1880 wrote to memory of 344	1880	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
PID 1880 wrote to memory of 344	1880	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
PID 1880 wrote to memory of 344	1880	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
PID 1880 wrote to memory of 344	1880	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
PID 1880 wrote to memory of 344	1880	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
PID 1880 wrote to memory of 344	1880	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
PID 1880 wrote to memory of 344	1880	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
PID 344 wrote to memory of 2628	344	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	schtasks.exe
PID 344 wrote to memory of 2628	344	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	schtasks.exe
PID 344 wrote to memory of 2628	344	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	schtasks.exe
PID 344 wrote to memory of 4768	344	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	svchost.exe
PID 344 wrote to memory of 4768	344	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	svchost.exe
PID 344 wrote to memory of 4768	344	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	svchost.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads