2ef1c8e9b1f5c39580ae0d9d54e512fbff0534e951c8e108b2b382d29d852526

General

Target

2ef1c8e9b1f5c39580ae0d9d54e512fbff0534e951c8e108b2b382d29d852526.exe
Size

922KB
MD5

ac1c4762e8cc90156e159bc5e60e3fc2
SHA1

70a5f77cbbc25788cf1bdbee377fdb50d1bcdba1
SHA256

2ef1c8e9b1f5c39580ae0d9d54e512fbff0534e951c8e108b2b382d29d852526
SHA512

5474ed58dddac711f3a6cb32f7fa21e56ad2eb60b025df4cc9377639783a402634acebd2618fdaee595d6ad9b4967adcf94fd595ef5e1b697a189ef578dced46
SSDEEP

24576:il60qMA5canSPzXdIBAp8AF1Loe8yjoFUG0A/PtDzr:iNqMWcaWIO8AFmioF5f/PZzr

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Setup.exe

pid process

1756 Setup.exe
Loads dropped DLL 1 IoCs

Processes:

2ef1c8e9b1f5c39580ae0d9d54e512fbff0534e951c8e108b2b382d29d852526.exe

pid process

1788 2ef1c8e9b1f5c39580ae0d9d54e512fbff0534e951c8e108b2b382d29d852526.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1756	Setup.exe

pid	process
1788	2ef1c8e9b1f5c39580ae0d9d54e512fbff0534e951c8e108b2b382d29d852526.exe

Modifies Internet Explorer settings 1 TTPs 7 IoCs

adware spyware

Modify Registry

T1112

Processes:

Setup.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS\Setup.exe = "1"	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Setup.exe = "0"	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS	Setup.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

2ef1c8e9b1f5c39580ae0d9d54e512fbff0534e951c8e108b2b382d29d852526.exe

description	pid	process	target process
PID 1788 wrote to memory of 1756	1788	2ef1c8e9b1f5c39580ae0d9d54e512fbff0534e951c8e108b2b382d29d852526.exe	Setup.exe
PID 1788 wrote to memory of 1756	1788	2ef1c8e9b1f5c39580ae0d9d54e512fbff0534e951c8e108b2b382d29d852526.exe	Setup.exe
PID 1788 wrote to memory of 1756	1788	2ef1c8e9b1f5c39580ae0d9d54e512fbff0534e951c8e108b2b382d29d852526.exe	Setup.exe
PID 1788 wrote to memory of 1756	1788	2ef1c8e9b1f5c39580ae0d9d54e512fbff0534e951c8e108b2b382d29d852526.exe	Setup.exe
PID 1788 wrote to memory of 1756	1788	2ef1c8e9b1f5c39580ae0d9d54e512fbff0534e951c8e108b2b382d29d852526.exe	Setup.exe
PID 1788 wrote to memory of 1756	1788	2ef1c8e9b1f5c39580ae0d9d54e512fbff0534e951c8e108b2b382d29d852526.exe	Setup.exe
PID 1788 wrote to memory of 1756	1788	2ef1c8e9b1f5c39580ae0d9d54e512fbff0534e951c8e108b2b382d29d852526.exe	Setup.exe

C:\Users\Admin\AppData\Local\Temp\2ef1c8e9b1f5c39580ae0d9d54e512fbff0534e951c8e108b2b382d29d852526.exe
"C:\Users\Admin\AppData\Local\Temp\2ef1c8e9b1f5c39580ae0d9d54e512fbff0534e951c8e108b2b382d29d852526.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1788

C:\Users\Admin\AppData\Local\Temp\a2p5ruzJZp\9lKnnZQa\Setup.exe
C:\Users\Admin\AppData\Local\Temp\a2p5ruzJZp\9lKnnZQa\Setup.exe --relaunch
2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
PID:1756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a2p5ruzJZp\9lKnnZQa\Setup.exe

Filesize
922KB

MD5
ac1c4762e8cc90156e159bc5e60e3fc2

SHA1
70a5f77cbbc25788cf1bdbee377fdb50d1bcdba1

SHA256
2ef1c8e9b1f5c39580ae0d9d54e512fbff0534e951c8e108b2b382d29d852526

SHA512
5474ed58dddac711f3a6cb32f7fa21e56ad2eb60b025df4cc9377639783a402634acebd2618fdaee595d6ad9b4967adcf94fd595ef5e1b697a189ef578dced46

Download Submit
C:\Users\Admin\AppData\Local\Temp\a2p5ruzJZp\9lKnnZQa\Setup.exe

Filesize
922KB

MD5
ac1c4762e8cc90156e159bc5e60e3fc2

SHA1
70a5f77cbbc25788cf1bdbee377fdb50d1bcdba1

SHA256
2ef1c8e9b1f5c39580ae0d9d54e512fbff0534e951c8e108b2b382d29d852526

SHA512
5474ed58dddac711f3a6cb32f7fa21e56ad2eb60b025df4cc9377639783a402634acebd2618fdaee595d6ad9b4967adcf94fd595ef5e1b697a189ef578dced46

Download Submit
\Users\Admin\AppData\Local\Temp\a2p5ruzJZp\9lKnnZQa\Setup.exe

Filesize
922KB

MD5
ac1c4762e8cc90156e159bc5e60e3fc2

SHA1
70a5f77cbbc25788cf1bdbee377fdb50d1bcdba1

SHA256
2ef1c8e9b1f5c39580ae0d9d54e512fbff0534e951c8e108b2b382d29d852526

SHA512
5474ed58dddac711f3a6cb32f7fa21e56ad2eb60b025df4cc9377639783a402634acebd2618fdaee595d6ad9b4967adcf94fd595ef5e1b697a189ef578dced46

Download Submit
memory/1756-56-0x0000000000000000-mapping.dmp

Download
memory/1788-54-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing