bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5

General

Target

bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
Size

611KB
MD5

899be157b06c0e3a98dd00ff57d7b633
SHA1

52c6d56244506686fae547845a5f2f7ca04c368d
SHA256

bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5
SHA512

fcfe193659aa97a784b0bfc9c0e6f60399bde2b596c092cec3e666014ffd9955b3f841bdc73713affdf5985e39ff1f3507210715b80bd0221caa198daf1d4a44
SSDEEP

12288:VWYCxxSVs/MQdyAtULk/2QoMkNB130sS62:juyQvmtc4B1

Score

6^/10

persistence ransomware

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DragonDay = "C:\\ProgramData\\DragonDay\\My\\0.0.0.0\\DragonDay.exe"	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\ALLEGIANCE.JPEG"	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe

pid	process
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe

description pid process

Token: SeDebugPrivilege 3040 bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe

description	pid	process
Token: SeDebugPrivilege	3040	bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe

C:\Users\Admin\AppData\Local\Temp\bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe
"C:\Users\Admin\AppData\Local\Temp\bf7beeebb100be3ee5f9b2f219969bbec1ff31a2868a21ff4558f10bcad634f5.exe"
1⤵
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3040

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4232

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3040-132-0x0000000000BC0000-0x0000000000C60000-memory.dmp

Filesize
640KB

Download
memory/3040-133-0x00000000055E0000-0x000000000567C000-memory.dmp

Filesize
624KB

Download
memory/3040-134-0x0000000005C50000-0x00000000061F4000-memory.dmp

Filesize
5.6MB

Download
memory/3040-135-0x0000000005740000-0x00000000057D2000-memory.dmp

Filesize
584KB

Download
memory/3040-136-0x00000000056A0000-0x00000000056AA000-memory.dmp

Filesize
40KB

Download
memory/3040-137-0x00000000057E0000-0x0000000005836000-memory.dmp

Filesize
344KB

Download
memory/3040-138-0x0000000009900000-0x0000000009A86000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads