0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309

General

Target

0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Size

3.3MB
MD5

ecaaf38c2271968b34e6a90c57bfbcb3
SHA1

423b509c6a9e0468356f77da2bb50b85b0ef9b46
SHA256

0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309
SHA512

ec6f88d8e214f72d7f68cdb3bf591014eafcb448a3e9c057b543d4beb3b99c4417e3d70955e7f2140eded9f9e7915126bd5983e81041421459a1880483b98f5e
SSDEEP

49152:R9v5sq6ISHls9mUfVqsYG+udIHlGG9FT6hniJmtmFx4S4LukEkX2bSBX+:RVmbEYG+aighniot84faVkX2bSBX+

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\PCGuard = "\"C:\\Users\\Admin\\AppData\\Roaming\\PCGuard\\PCGuard.exe\" start"	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

Processes:

0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Token: SeIncBasePriorityPrivilege	1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe

pid process

1236 0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe

pid process

1236 0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe

pid	process
1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
1236	0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe

C:\Users\Admin\AppData\Local\Temp\0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe
"C:\Users\Admin\AppData\Local\Temp\0be5e76e823b8a0bde76a8b326470683ff4997f5912036af916021e6cb5bd309.exe"
1⤵
- Adds Run key to start application
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1236