c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f

General

Target

c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
Size

68KB
MD5

f1965dfea9a514d0459576b75cde9658
SHA1

396a48aaca2f960ef591ae93049edb0f9b3b3554
SHA256

c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f
SHA512

1c5a37fb803993dd2c5d1023336b352dcb9bcb2dd99fb6b8f49b360125e833ceef16275cf98cb91bc5a42247e816ba314e46c27c3d670acce446bd597f446414
SSDEEP

768:fcjliTdmoAl+qOQSgFrhKo//WomvdfQXwYt1IEDIefZsK:0jIxjAcqOK3qowgnt1d

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exeAdmin.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Admin.exe

Executes dropped EXE 1 IoCs

Processes:

Admin.exe

pid process

1880 Admin.exe

pid	process
1880	Admin.exe

Loads dropped DLL 2 IoCs

Processes:

c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe

pid	process
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exeAdmin.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe"	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	Admin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe"	Admin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exeAdmin.exe

pid	process
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1880	Admin.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1880	Admin.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1880	Admin.exe
1880	Admin.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1880	Admin.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1880	Admin.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1880	Admin.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1880	Admin.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1880	Admin.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1880	Admin.exe
1880	Admin.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1880	Admin.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1880	Admin.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1880	Admin.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1880	Admin.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1880	Admin.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1880	Admin.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1880	Admin.exe
1880	Admin.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1880	Admin.exe
1880	Admin.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1880	Admin.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1880	Admin.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1880	Admin.exe
1880	Admin.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1880	Admin.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1880	Admin.exe
1880	Admin.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1880	Admin.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1880	Admin.exe
1880	Admin.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exeAdmin.exe

pid process

1768 c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
1880 Admin.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe

description	pid	process	target process
PID 1768 wrote to memory of 1880	1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe	Admin.exe
PID 1768 wrote to memory of 1880	1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe	Admin.exe
PID 1768 wrote to memory of 1880	1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe	Admin.exe
PID 1768 wrote to memory of 1880	1768	c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe	Admin.exe

C:\Users\Admin\AppData\Local\Temp\c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe
"C:\Users\Admin\AppData\Local\Temp\c68d204738cb101c896b33592939168cf1fbc100753ed4f61cc5a11a98876b6f.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768

C:\Users\Admin\Admin.exe
"C:\Users\Admin\Admin.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1880

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Admin.exe

Filesize
68KB

MD5
75334142062bb906481514c5f202d4db

SHA1
f60372c741b0b4add24b1a464c46bc1706185e6c

SHA256
de053f615b71f8b816a27d9c46c92b7a2974aaee2041c875d7d0762ca88bf7e1

SHA512
1fe44edb2819c51463125dc7dab2cb2ac43d79eb68261909f1c18b0e6e118e165ba58c0a9f99947863e142bb5e96860444082b55e26b379aff30594c4b47a527

Download Submit
\Users\Admin\Admin.exe

Filesize
68KB

MD5
75334142062bb906481514c5f202d4db

SHA1
f60372c741b0b4add24b1a464c46bc1706185e6c

SHA256
de053f615b71f8b816a27d9c46c92b7a2974aaee2041c875d7d0762ca88bf7e1

SHA512
1fe44edb2819c51463125dc7dab2cb2ac43d79eb68261909f1c18b0e6e118e165ba58c0a9f99947863e142bb5e96860444082b55e26b379aff30594c4b47a527

Download Submit
\Users\Admin\Admin.exe

Filesize
68KB

MD5
75334142062bb906481514c5f202d4db

SHA1
f60372c741b0b4add24b1a464c46bc1706185e6c

SHA256
de053f615b71f8b816a27d9c46c92b7a2974aaee2041c875d7d0762ca88bf7e1

SHA512
1fe44edb2819c51463125dc7dab2cb2ac43d79eb68261909f1c18b0e6e118e165ba58c0a9f99947863e142bb5e96860444082b55e26b379aff30594c4b47a527

Download Submit
memory/1768-54-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1768-57-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download
memory/1880-60-0x0000000000000000-mapping.dmp

Download
memory/1880-62-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads