290c18628497b3e06123ab7c8d780c45bda395dbbd583199e310233b17323b09

General

Target

290c18628497b3e06123ab7c8d780c45bda395dbbd583199e310233b17323b09.exe
Size

294KB
MD5

fabce060cb66a07b7a94869811170fde
SHA1

3ef6cf6a9b56442ff0ae4440df492ce13f53b5aa
SHA256

290c18628497b3e06123ab7c8d780c45bda395dbbd583199e310233b17323b09
SHA512

8d3c6c821b9d063c191e54913f3d50a2d2c963a1f0e4f413dd6b7f975e395177365b65cf336eda043fedc55651cc81450b9470dcdfd6bcaecd8fcb104f7b5572
SSDEEP

6144:n/0uo4Fb3TzzCVkfuqDVABIgVmqZ04H6nfCXvC:nJNt+VqsHwCXvC

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

abc.exesmss.exe

pid process

1812 abc.exe
1692 smss.exe

pid	process
1812	abc.exe
1692	smss.exe

Loads dropped DLL 3 IoCs

Processes:

290c18628497b3e06123ab7c8d780c45bda395dbbd583199e310233b17323b09.exeabc.exe

pid	process
364	290c18628497b3e06123ab7c8d780c45bda395dbbd583199e310233b17323b09.exe
364	290c18628497b3e06123ab7c8d780c45bda395dbbd583199e310233b17323b09.exe
1812	abc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

290c18628497b3e06123ab7c8d780c45bda395dbbd583199e310233b17323b09.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	290c18628497b3e06123ab7c8d780c45bda395dbbd583199e310233b17323b09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	290c18628497b3e06123ab7c8d780c45bda395dbbd583199e310233b17323b09.exe

Drops file in System32 directory 1 IoCs

Processes:

smss.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	smss.exe

Drops file in Program Files directory 2 IoCs

Processes:

abc.exe

description	ioc	process
File created	C:\Program Files (x86)\Outlook Express\smss.exe	abc.exe
File opened for modification	C:\Program Files (x86)\Outlook Express\smss.exe	abc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 14 IoCs

Processes:

smss.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{08244EE6-92F0-47F2-9FC9-929BAA2E7235} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 0100000000000000104a2d1d7f01d901	smss.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	smss.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 010000000000000090aefd1c7f01d901	smss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	smss.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	smss.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{920E6DB1-9907-4370-B3A0-BAFC03D81399} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 0100000000000000f00f001d7f01d901	smss.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{16F3DD56-1AF5-4347-846D-7C10C4192619} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 01000000000000005071021d7f01d901	smss.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 0100000000000000b0d2041d7f01d901	smss.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	smss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	smss.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{99FD978C-D287-4F50-827F-B2C658EDA8E7} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 010000000000000090aefd1c7f01d901	smss.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	smss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	smss.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 0100000000000000304dfb1c7f01d901	smss.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

smss.exe

description pid process

Token: SeDebugPrivilege 1692 smss.exe

description	pid	process
Token: SeDebugPrivilege	1692	smss.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

290c18628497b3e06123ab7c8d780c45bda395dbbd583199e310233b17323b09.exeabc.exe

description	pid	process	target process
PID 364 wrote to memory of 1812	364	290c18628497b3e06123ab7c8d780c45bda395dbbd583199e310233b17323b09.exe	abc.exe
PID 364 wrote to memory of 1812	364	290c18628497b3e06123ab7c8d780c45bda395dbbd583199e310233b17323b09.exe	abc.exe
PID 364 wrote to memory of 1812	364	290c18628497b3e06123ab7c8d780c45bda395dbbd583199e310233b17323b09.exe	abc.exe
PID 364 wrote to memory of 1812	364	290c18628497b3e06123ab7c8d780c45bda395dbbd583199e310233b17323b09.exe	abc.exe
PID 364 wrote to memory of 1812	364	290c18628497b3e06123ab7c8d780c45bda395dbbd583199e310233b17323b09.exe	abc.exe
PID 364 wrote to memory of 1812	364	290c18628497b3e06123ab7c8d780c45bda395dbbd583199e310233b17323b09.exe	abc.exe
PID 364 wrote to memory of 1812	364	290c18628497b3e06123ab7c8d780c45bda395dbbd583199e310233b17323b09.exe	abc.exe
PID 1812 wrote to memory of 944	1812	abc.exe	cmd.exe
PID 1812 wrote to memory of 944	1812	abc.exe	cmd.exe
PID 1812 wrote to memory of 944	1812	abc.exe	cmd.exe
PID 1812 wrote to memory of 944	1812	abc.exe	cmd.exe
PID 1812 wrote to memory of 944	1812	abc.exe	cmd.exe
PID 1812 wrote to memory of 944	1812	abc.exe	cmd.exe
PID 1812 wrote to memory of 944	1812	abc.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\290c18628497b3e06123ab7c8d780c45bda395dbbd583199e310233b17323b09.exe
"C:\Users\Admin\AppData\Local\Temp\290c18628497b3e06123ab7c8d780c45bda395dbbd583199e310233b17323b09.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:364
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\abc.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\abc.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\1305.bat
    3⤵
    PID:944

C:\Program Files (x86)\Outlook Express\smss.exe
"C:\Program Files (x86)\Outlook Express\smss.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Outlook Express\smss.exe

Filesize
536KB

MD5
c93e45df0890ba24410a1cf42f98ee17

SHA1
1ecdd453b984270deb8152bf234ce10989571589

SHA256
6b483cf943c8f7c9653a4cfb872da8d97d20b57b1c1f818ac72df60c368025b6

SHA512
468dc6062c35023c6e3fe781d44d498c75d18a94d32c4bd62a87f71f63621d1665770d36ec046846b8e8a535a38227b699587908d5df1e9124514dedb9715f3b

Download Submit
C:\Program Files (x86)\Outlook Express\smss.exe

Filesize
536KB

MD5
c93e45df0890ba24410a1cf42f98ee17

SHA1
1ecdd453b984270deb8152bf234ce10989571589

SHA256
6b483cf943c8f7c9653a4cfb872da8d97d20b57b1c1f818ac72df60c368025b6

SHA512
468dc6062c35023c6e3fe781d44d498c75d18a94d32c4bd62a87f71f63621d1665770d36ec046846b8e8a535a38227b699587908d5df1e9124514dedb9715f3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1305.bat

Filesize
162B

MD5
274d5fb395f06f064947b7907f2567d6

SHA1
5c15662b6030ca43a85a642b20213cc37dbe7c7d

SHA256
c9799b3f487f05afe25a03456b3d4e810a8eebe8955377d321c019ca83057819

SHA512
78140f6595dc2982070b744204c7b3fad4254de7cd5786e69c0e26e57e26c44764d7ca32ac8583bf494dcc81e51673313d8d7f9071f964e43c9a6b1adb2d091e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\abc.exe

Filesize
536KB

MD5
c93e45df0890ba24410a1cf42f98ee17

SHA1
1ecdd453b984270deb8152bf234ce10989571589

SHA256
6b483cf943c8f7c9653a4cfb872da8d97d20b57b1c1f818ac72df60c368025b6

SHA512
468dc6062c35023c6e3fe781d44d498c75d18a94d32c4bd62a87f71f63621d1665770d36ec046846b8e8a535a38227b699587908d5df1e9124514dedb9715f3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\abc.exe

Filesize
536KB

MD5
c93e45df0890ba24410a1cf42f98ee17

SHA1
1ecdd453b984270deb8152bf234ce10989571589

SHA256
6b483cf943c8f7c9653a4cfb872da8d97d20b57b1c1f818ac72df60c368025b6

SHA512
468dc6062c35023c6e3fe781d44d498c75d18a94d32c4bd62a87f71f63621d1665770d36ec046846b8e8a535a38227b699587908d5df1e9124514dedb9715f3b

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\abc.exe

Filesize
536KB

MD5
c93e45df0890ba24410a1cf42f98ee17

SHA1
1ecdd453b984270deb8152bf234ce10989571589

SHA256
6b483cf943c8f7c9653a4cfb872da8d97d20b57b1c1f818ac72df60c368025b6

SHA512
468dc6062c35023c6e3fe781d44d498c75d18a94d32c4bd62a87f71f63621d1665770d36ec046846b8e8a535a38227b699587908d5df1e9124514dedb9715f3b

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\abc.exe

Filesize
536KB

MD5
c93e45df0890ba24410a1cf42f98ee17

SHA1
1ecdd453b984270deb8152bf234ce10989571589

SHA256
6b483cf943c8f7c9653a4cfb872da8d97d20b57b1c1f818ac72df60c368025b6

SHA512
468dc6062c35023c6e3fe781d44d498c75d18a94d32c4bd62a87f71f63621d1665770d36ec046846b8e8a535a38227b699587908d5df1e9124514dedb9715f3b

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\abc.exe

Filesize
536KB

MD5
c93e45df0890ba24410a1cf42f98ee17

SHA1
1ecdd453b984270deb8152bf234ce10989571589

SHA256
6b483cf943c8f7c9653a4cfb872da8d97d20b57b1c1f818ac72df60c368025b6

SHA512
468dc6062c35023c6e3fe781d44d498c75d18a94d32c4bd62a87f71f63621d1665770d36ec046846b8e8a535a38227b699587908d5df1e9124514dedb9715f3b

Download Submit
memory/364-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/944-64-0x0000000000000000-mapping.dmp

Download
memory/1812-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads