5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

General

Target

5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe
Size

405KB
MD5

2d8d691ccebd25cbbf801a519b964a5b
SHA1

1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc
SHA256

5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd
SHA512

8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c
SSDEEP

12288:VkqanzfVnl6VCB+lHOWbtOBEtV1H8UTAti5:VkqanhoAyx2Vc5

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Windows\\system32\\InstallDir\\Server.exe"	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Windows\\system32\\InstallDir\\Server.exe"	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Windows\\system32\\InstallDir\\Server.exe"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Windows\\system32\\InstallDir\\Server.exe"	svchost.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\Server.exe"	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\Server.exe"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\Server.exe"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\Server.exe"	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe

Drops file in System32 directory 3 IoCs

Processes:

5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe
File created	C:\Windows\SysWOW64\InstallDir\Server.exe	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe

description	pid	process	target process
PID 3104 wrote to memory of 3384	3104	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 3104 wrote to memory of 3384	3104	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 3104 wrote to memory of 3384	3104	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 3104 wrote to memory of 3384	3104	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 3104 wrote to memory of 5020	3104	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 3104 wrote to memory of 5020	3104	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 3104 wrote to memory of 5020	3104	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe
"C:\Users\Admin\AppData\Local\Temp\5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe"
1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3104

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Adds policy Run key to start application
- Adds Run key to start application
PID:3384

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
PID:5020

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
memory/3384-132-0x0000000000000000-mapping.dmp

Download
memory/3384-133-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3384-135-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads