4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e

General

Target

4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe
Size

3.7MB
MD5

6b8015378ec1105a5642c6b1b4939ee4
SHA1

66accd7c86ad5f7f86f961b41ad488b4f3046e80
SHA256

4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e
SHA512

54c6181bc1d44b2a60ab1e700d9e52151402c60d47ab89c346c984184da8bfdbe6ceedf88bdf1d03f35937398ee36af17f30a00e9183b26fe2913bd5fa58a4d8
SSDEEP

49152:aMwouEnPJnQL0dYKGLQWhhdDdMc48uTEda8nqcjoWI:F5PJnTdhcyEw1b

Score

10^/10

persistence

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Runservices	4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\AngelSoft\iparmor	4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe
Key created	\REGISTRY\USER\.DEFAULT	4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\AngelSoft	4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\AngelSoft\iparmor	4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open\command	4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\chm.file	4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell	4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open	4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command	4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1728	4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe
1728	4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1728	4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe
1728	4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe
1728	4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe
1728	4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe
1728	4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe
1728	4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
1728	4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe
1728	4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe
1728	4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe
1728	4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe
1728	4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe
1728	4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe

C:\Users\Admin\AppData\Local\Temp\4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe
"C:\Users\Admin\AppData\Local\Temp\4abf163454d77bef89c4ae781e4684bfba5aa19cc44a3a453085dd1923f1ce6e.exe"
1⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1728

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1728-54-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

Filesize
8KB

Download
memory/1728-55-0x0000000000400000-0x00000000007BA000-memory.dmp

Filesize
3.7MB

Download
memory/1728-56-0x0000000005D80000-0x0000000005D90000-memory.dmp

Filesize
64KB

Download
memory/1728-57-0x0000000000400000-0x00000000007BA000-memory.dmp

Filesize
3.7MB

Download
memory/1728-58-0x0000000005D80000-0x0000000005D90000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads