2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224

General

Target

2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe
Size

95KB
MD5

e8c4741eb950dc6e2936fbb82b69f20d
SHA1

6b4a143184b535f2dd8cdb439277817e297e92d1
SHA256

2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224
SHA512

1950080032605533bddbb65930140ffc30b6b7c0eecb4e080593fad00c72d8d84668a31790a85240bd9dac33cf7641e3c2eee12ed40ff73dcc8b94ac615233b8
SSDEEP

1536:V4UHxpN/MUXsLTvCj0DBXJaOvWHzw0reZBIN85ymPhJ58YMztlsIgzZUKaV/O:V4URpNUUX6z/DBXJfvWTw6IIN8xX58Zm

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\32922 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\msyvumc.com"	svchost.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

1192 svchost.exe
Loads dropped DLL 1 IoCs

Processes:

2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe

pid process

1308 2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe

pid	process
1192	svchost.exe

pid	process
1308	2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe

description	pid	process	target process
PID 1308 set thread context of 744	1308	2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe	2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe

Drops file in Program Files directory 1 IoCs

Processes:

svchost.exe

description ioc process

File created C:\PROGRA~3\LOCALS~1\Temp\msyvumc.com svchost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe

pid process

744 2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe

description	ioc	process
File created	C:\PROGRA~3\LOCALS~1\Temp\msyvumc.com	svchost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe

pid	process
744	2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe
744	2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe

description	pid	process	target process
PID 1308 wrote to memory of 744	1308	2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe	2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe
PID 1308 wrote to memory of 744	1308	2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe	2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe
PID 1308 wrote to memory of 744	1308	2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe	2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe
PID 1308 wrote to memory of 744	1308	2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe	2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe
PID 1308 wrote to memory of 744	1308	2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe	2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe
PID 1308 wrote to memory of 744	1308	2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe	2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe
PID 1308 wrote to memory of 744	1308	2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe	2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe
PID 1308 wrote to memory of 744	1308	2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe	2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe
PID 1308 wrote to memory of 744	1308	2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe	2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe
PID 1308 wrote to memory of 744	1308	2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe	2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe
PID 744 wrote to memory of 1192	744	2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe	svchost.exe
PID 744 wrote to memory of 1192	744	2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe	svchost.exe
PID 744 wrote to memory of 1192	744	2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe	svchost.exe
PID 744 wrote to memory of 1192	744	2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe
"C:\Users\Admin\AppData\Local\Temp\2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Users\Admin\AppData\Local\Temp\2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe
  "C:\Users\Admin\AppData\Local\Temp\2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe"
  2⤵
  - Maps connected drives based on registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:744
- - C:\Windows\syswow64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    - Adds policy Run key to start application
    - Deletes itself
    - Drops file in Program Files directory
    PID:1192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nse980D.tmp\Tyndale.dll

Filesize
67KB

MD5
493cf0f265ea7e90bc3aab5daebed560

SHA1
1ae2744ea9f4698a14c7a3704b80e74ca3a0a198

SHA256
814d634c09c0cac0b4d77395591ea1143028ce39b9f4fff3c38e1ac9f5518817

SHA512
856e42602e5ecadfb89cf41390ad6615979c1aae8bb43a96587c8e8380c838f831820d364748448b6516d695f4005ec139b8571777ac472ba6c8ef4b44224e5e

Download Submit
memory/744-57-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/744-58-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/744-60-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/744-61-0x000000000040141C-mapping.dmp

Download
memory/1192-62-0x0000000000000000-mapping.dmp

Download
memory/1192-63-0x00000000002D0000-0x00000000002D8000-memory.dmp

Filesize
32KB

Download
memory/1192-64-0x0000000000020000-0x0000000000025000-memory.dmp

Filesize
20KB

Download
memory/1192-65-0x0000000000020000-0x0000000000025000-memory.dmp

Filesize
20KB

Download
memory/1308-54-0x0000000076941000-0x0000000076943000-memory.dmp

Filesize
8KB

Download
memory/1308-56-0x0000000001C70000-0x0000000001C8A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads