4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062

General

Target

4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
Size

68KB
MD5

bde2cf19babeef409e7e3291354cd1d5
SHA1

1aab90310ca645c9b1847647dac1ad3e5bfdaad8
SHA256

4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062
SHA512

2a80f967f00bdfdbb580f9be0a3de97fe8588cc815389ec671b2cf16aa10c05d821c2d8530aa78d5bc82bade2836fd1f2381b945579fb1febf0853715cac24b4
SSDEEP

768:4c0liTd6flOAl+qOQSgFrhKo//WomvdfQXwYt1IEDIefZsK:n0IxnAcqOK3qowgnt1d

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

Admin.exe4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Admin.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe

Executes dropped EXE 1 IoCs

Processes:

Admin.exe

pid process

1936 Admin.exe

pid	process
1936	Admin.exe

Loads dropped DLL 2 IoCs

Processes:

4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe

pid	process
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Admin.exe4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	Admin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe"	Admin.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe"	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exeAdmin.exe

pid	process
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1936	Admin.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1936	Admin.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1936	Admin.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1936	Admin.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1936	Admin.exe
1936	Admin.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1936	Admin.exe
1936	Admin.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1936	Admin.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1936	Admin.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1936	Admin.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1936	Admin.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1936	Admin.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1936	Admin.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1936	Admin.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1936	Admin.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1936	Admin.exe
1936	Admin.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1936	Admin.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1936	Admin.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1936	Admin.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1936	Admin.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1936	Admin.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1936	Admin.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1936	Admin.exe
1936	Admin.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1936	Admin.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1936	Admin.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1936	Admin.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1936	Admin.exe
1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1936	Admin.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exeAdmin.exe

pid process

1660 4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
1936 Admin.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe

description	pid	process	target process
PID 1660 wrote to memory of 1936	1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe	Admin.exe
PID 1660 wrote to memory of 1936	1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe	Admin.exe
PID 1660 wrote to memory of 1936	1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe	Admin.exe
PID 1660 wrote to memory of 1936	1660	4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe	Admin.exe

C:\Users\Admin\AppData\Local\Temp\4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe
"C:\Users\Admin\AppData\Local\Temp\4d4409858304e157072cef2fa279f9fe02bb4c519bed12942ec51a9e87a52062.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660

C:\Users\Admin\Admin.exe
"C:\Users\Admin\Admin.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Admin.exe

Filesize
68KB

MD5
c6413a989815d312a5f11e3a1b1a4046

SHA1
83a4be73c8f82098d25245b21d0b1fb56ba2f68e

SHA256
f09af9020c0870810181d412435c1cc51c90ea08106641f5a8415ab906a39a87

SHA512
a831643e54e373a936821002991662a4ff8c9c6df84934c1669b203d30ce935d47533b2f56a34e4cfe4cbd94329eb29595831e82f586f1d96ca7697bd1788378

Download Submit
\Users\Admin\Admin.exe

Filesize
68KB

MD5
c6413a989815d312a5f11e3a1b1a4046

SHA1
83a4be73c8f82098d25245b21d0b1fb56ba2f68e

SHA256
f09af9020c0870810181d412435c1cc51c90ea08106641f5a8415ab906a39a87

SHA512
a831643e54e373a936821002991662a4ff8c9c6df84934c1669b203d30ce935d47533b2f56a34e4cfe4cbd94329eb29595831e82f586f1d96ca7697bd1788378

Download Submit
\Users\Admin\Admin.exe

Filesize
68KB

MD5
c6413a989815d312a5f11e3a1b1a4046

SHA1
83a4be73c8f82098d25245b21d0b1fb56ba2f68e

SHA256
f09af9020c0870810181d412435c1cc51c90ea08106641f5a8415ab906a39a87

SHA512
a831643e54e373a936821002991662a4ff8c9c6df84934c1669b203d30ce935d47533b2f56a34e4cfe4cbd94329eb29595831e82f586f1d96ca7697bd1788378

Download Submit
memory/1660-54-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1660-57-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download
memory/1936-60-0x0000000000000000-mapping.dmp

Download
memory/1936-62-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads