7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e

General

Target

7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e.exe
Size

1.0MB
MD5

d4708cb991a6abe86d877a8b8f0ad036
SHA1

6e449488a9f6d9d387bc97e637fa417e4def5a0d
SHA256

7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e
SHA512

344ee606ffc210299530e7b9b0c2a28f1ad82742599c222dc26bd6ab7b3fb766acab2c507d2b481561aeb3053f05543a112aac34945f1f7ff89dfbe74ed62a0d
SSDEEP

24576:l23y4Wyxw++2nojWntSS/dFCTs6maC8JcvlcVYUvZB35L:l23yVUw2nojWnjCA6NCekKLvZpt

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

67220320.exe

pid process

688 67220320.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

672 cmd.exe
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

932 cmd.exe
932 cmd.exe

pid	process
688	67220320.exe

pid	process
672	cmd.exe

pid	process
932	cmd.exe
932	cmd.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

67220320.exe7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\67220320 = "C:\\PROGRA~3\\67220320\\67220320.exe"	67220320.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\67220320 = "C:\\ProgramData\\67220320\\67220320.exe"	7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	67220320.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1900 taskkill.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 1900 taskkill.exe

pid	process
1900	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	1900	taskkill.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e.execmd.execmd.exe

description	pid	process	target process
PID 1780 wrote to memory of 672	1780	7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e.exe	cmd.exe
PID 1780 wrote to memory of 672	1780	7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e.exe	cmd.exe
PID 1780 wrote to memory of 672	1780	7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e.exe	cmd.exe
PID 1780 wrote to memory of 672	1780	7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e.exe	cmd.exe
PID 672 wrote to memory of 1900	672	cmd.exe	taskkill.exe
PID 672 wrote to memory of 1900	672	cmd.exe	taskkill.exe
PID 672 wrote to memory of 1900	672	cmd.exe	taskkill.exe
PID 672 wrote to memory of 1900	672	cmd.exe	taskkill.exe
PID 672 wrote to memory of 932	672	cmd.exe	cmd.exe
PID 672 wrote to memory of 932	672	cmd.exe	cmd.exe
PID 672 wrote to memory of 932	672	cmd.exe	cmd.exe
PID 672 wrote to memory of 932	672	cmd.exe	cmd.exe
PID 932 wrote to memory of 688	932	cmd.exe	67220320.exe
PID 932 wrote to memory of 688	932	cmd.exe	67220320.exe
PID 932 wrote to memory of 688	932	cmd.exe	67220320.exe
PID 932 wrote to memory of 688	932	cmd.exe	67220320.exe

C:\Users\Admin\AppData\Local\Temp\7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e.exe
"C:\Users\Admin\AppData\Local\Temp\7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1780

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\ProgramData\67220320\67220320.bat" "
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:672

C:\Windows\SysWOW64\taskkill.exe
taskkill /im 7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e.exe /f
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1900

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start C:\PROGRA~3\67220320\67220320.exe /install
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:932

C:\PROGRA~3\67220320\67220320.exe
C:\PROGRA~3\67220320\67220320.exe /install
4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:688

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\67220320\67220320.exe
Filesize
1.0MB

MD5
d4708cb991a6abe86d877a8b8f0ad036

SHA1
6e449488a9f6d9d387bc97e637fa417e4def5a0d

SHA256
7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e

SHA512
344ee606ffc210299530e7b9b0c2a28f1ad82742599c222dc26bd6ab7b3fb766acab2c507d2b481561aeb3053f05543a112aac34945f1f7ff89dfbe74ed62a0d

Download Submit
C:\PROGRA~3\67220320\67220320.exe
Filesize
1.0MB

MD5
d4708cb991a6abe86d877a8b8f0ad036

SHA1
6e449488a9f6d9d387bc97e637fa417e4def5a0d

SHA256
7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e

SHA512
344ee606ffc210299530e7b9b0c2a28f1ad82742599c222dc26bd6ab7b3fb766acab2c507d2b481561aeb3053f05543a112aac34945f1f7ff89dfbe74ed62a0d

Download Submit
C:\ProgramData\67220320\67220320.bat
Filesize
322B

MD5
c0ac8ef772c5dc2312488683453a2f3a

SHA1
d30b387a680be181833717e21f2fe2f2e5e2adfa

SHA256
0fa8da1f55493383959a692f3c513e3d6a56087e0c8a5d4ec7368af1256d77ad

SHA512
714151ee8d2e5528a8f5e4ca17f73a66e07a63ce892879bd501dd012ebc5bfae930baf7e7e7a97b6006e8f314b43668081c0ebaea3e5a17da6e7139648ac8532

Download Submit
\PROGRA~3\67220320\67220320.exe
Filesize
1.0MB

MD5
d4708cb991a6abe86d877a8b8f0ad036

SHA1
6e449488a9f6d9d387bc97e637fa417e4def5a0d

SHA256
7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e

SHA512
344ee606ffc210299530e7b9b0c2a28f1ad82742599c222dc26bd6ab7b3fb766acab2c507d2b481561aeb3053f05543a112aac34945f1f7ff89dfbe74ed62a0d

Download Submit
\PROGRA~3\67220320\67220320.exe
Filesize
1.0MB

MD5
d4708cb991a6abe86d877a8b8f0ad036

SHA1
6e449488a9f6d9d387bc97e637fa417e4def5a0d

SHA256
7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e

SHA512
344ee606ffc210299530e7b9b0c2a28f1ad82742599c222dc26bd6ab7b3fb766acab2c507d2b481561aeb3053f05543a112aac34945f1f7ff89dfbe74ed62a0d

Download Submit
memory/672-58-0x0000000000000000-mapping.dmp

Download
memory/688-66-0x0000000000000000-mapping.dmp

Download
memory/688-69-0x0000000000800000-0x00000000009F6000-memory.dmp

Filesize
2.0MB

Download
memory/688-71-0x0000000000400000-0x00000000005F6000-memory.dmp

Filesize
2.0MB

Download
memory/932-62-0x0000000000000000-mapping.dmp

Download
memory/1780-59-0x0000000000400000-0x00000000005F6000-memory.dmp

Filesize
2.0MB

Download
memory/1780-57-0x0000000000400000-0x00000000005F6000-memory.dmp

Filesize
2.0MB

Download
memory/1780-56-0x00000000007F0000-0x00000000009E6000-memory.dmp

Filesize
2.0MB

Download
memory/1780-54-0x00000000007F0000-0x00000000009E6000-memory.dmp

Filesize
2.0MB

Download
memory/1780-55-0x00000000761E1000-0x00000000761E3000-memory.dmp

Filesize
8KB

Download
memory/1900-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing