7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e

General

Target

7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e.exe
Size

1.0MB
MD5

d4708cb991a6abe86d877a8b8f0ad036
SHA1

6e449488a9f6d9d387bc97e637fa417e4def5a0d
SHA256

7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e
SHA512

344ee606ffc210299530e7b9b0c2a28f1ad82742599c222dc26bd6ab7b3fb766acab2c507d2b481561aeb3053f05543a112aac34945f1f7ff89dfbe74ed62a0d
SSDEEP

24576:l23y4Wyxw++2nojWntSS/dFCTs6maC8JcvlcVYUvZB35L:l23yVUw2nojWnjCA6NCekKLvZpt

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

03019720.exe

pid process

3004 03019720.exe

pid	process
3004	03019720.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

03019720.exe7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	03019720.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\03019720 = "C:\\PROGRA~3\\03019720\\03019720.exe"	03019720.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\03019720 = "C:\\ProgramData\\03019720\\03019720.exe"	7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

3132 taskkill.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 3132 taskkill.exe

pid	process
3132	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	3132	taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e.execmd.execmd.exe

description	pid	process	target process
PID 3348 wrote to memory of 224	3348	7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e.exe	cmd.exe
PID 3348 wrote to memory of 224	3348	7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e.exe	cmd.exe
PID 3348 wrote to memory of 224	3348	7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e.exe	cmd.exe
PID 224 wrote to memory of 3132	224	cmd.exe	taskkill.exe
PID 224 wrote to memory of 3132	224	cmd.exe	taskkill.exe
PID 224 wrote to memory of 3132	224	cmd.exe	taskkill.exe
PID 224 wrote to memory of 764	224	cmd.exe	cmd.exe
PID 224 wrote to memory of 764	224	cmd.exe	cmd.exe
PID 224 wrote to memory of 764	224	cmd.exe	cmd.exe
PID 764 wrote to memory of 3004	764	cmd.exe	03019720.exe
PID 764 wrote to memory of 3004	764	cmd.exe	03019720.exe
PID 764 wrote to memory of 3004	764	cmd.exe	03019720.exe

C:\Users\Admin\AppData\Local\Temp\7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e.exe
"C:\Users\Admin\AppData\Local\Temp\7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3348

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\03019720\03019720.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:224

C:\Windows\SysWOW64\taskkill.exe
taskkill /im 7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e.exe /f
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3132

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start C:\PROGRA~3\03019720\03019720.exe /install
3⤵
- Suspicious use of WriteProcessMemory
PID:764

C:\PROGRA~3\03019720\03019720.exe
C:\PROGRA~3\03019720\03019720.exe /install
4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3004

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\03019720\03019720.exe
Filesize
1.0MB

MD5
d4708cb991a6abe86d877a8b8f0ad036

SHA1
6e449488a9f6d9d387bc97e637fa417e4def5a0d

SHA256
7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e

SHA512
344ee606ffc210299530e7b9b0c2a28f1ad82742599c222dc26bd6ab7b3fb766acab2c507d2b481561aeb3053f05543a112aac34945f1f7ff89dfbe74ed62a0d

Download Submit
C:\ProgramData\03019720\03019720.bat
Filesize
322B

MD5
c3d1d2876c8f867d1262106b2704994d

SHA1
96942a22757e303ef1b159e8eca19b8e8bf0cdb4

SHA256
3149786c759b5d2f0641dd4221914cd8e09db91b306ba8077a031a305c106688

SHA512
62c45c51ba001b4493e59d0fb3c59b4d754940e1775933e7e71556db75e6c6f928af6314f7ef8877fc248624f5e0d9d8d28d4786329ccd605816af4ccae835e9

Download Submit
C:\ProgramData\03019720\03019720.exe
Filesize
1.0MB

MD5
d4708cb991a6abe86d877a8b8f0ad036

SHA1
6e449488a9f6d9d387bc97e637fa417e4def5a0d

SHA256
7e0857abf28c6e5cb823586bc7aa6163a7838dac9d648de1535cd10beb9a2f2e

SHA512
344ee606ffc210299530e7b9b0c2a28f1ad82742599c222dc26bd6ab7b3fb766acab2c507d2b481561aeb3053f05543a112aac34945f1f7ff89dfbe74ed62a0d

Download Submit
memory/224-135-0x0000000000000000-mapping.dmp

Download
memory/764-139-0x0000000000000000-mapping.dmp

Download
memory/3004-140-0x0000000000000000-mapping.dmp

Download
memory/3004-144-0x0000000000830000-0x0000000000A26000-memory.dmp

Filesize
2.0MB

Download
memory/3004-145-0x0000000000400000-0x00000000005F6000-memory.dmp

Filesize
2.0MB

Download
memory/3004-146-0x0000000000400000-0x00000000005F6000-memory.dmp

Filesize
2.0MB

Download
memory/3132-138-0x0000000000000000-mapping.dmp

Download
memory/3348-136-0x0000000000400000-0x00000000005F6000-memory.dmp

Filesize
2.0MB

Download
memory/3348-132-0x0000000000900000-0x0000000000AF6000-memory.dmp

Filesize
2.0MB

Download
memory/3348-134-0x0000000000400000-0x00000000005F6000-memory.dmp

Filesize
2.0MB

Download
memory/3348-133-0x0000000000900000-0x0000000000AF6000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads