06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4

General

Target

06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4.exe
Size

272KB
MD5

3a282cfac08382f2d7375c07940f9928
SHA1

9af13e0087e852d97b677b760f48508f8024079f
SHA256

06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4
SHA512

116f2e8e1016004a4fe2e73695b352ff694ad86ebeabec49ad074356bc0b007e84360bd7bf42f2ca5af158c357a40bd88752e30140d23738c558a6bdc29e3181
SSDEEP

3072:hx95KsTHRKR8tLHL6mt0IURO25ZnuN9peRVsFJWvf9+XARmhm2I8lgKaMyVWZJm:v95KCxTLrl453uN9oR2FbXe2IfRqfm

Score

8^/10

evasion persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

server.exeserver.exe

pid process

4548 server.exe
4764 server.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

3400 netsh.exe

pid	process
4548	server.exe
4764	server.exe

pid	process
3400	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

server.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6846a95408fac51f94fc52389805f6fc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .."	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\6846a95408fac51f94fc52389805f6fc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .."	server.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4.exeserver.exe

description	pid	process	target process
PID 2900 set thread context of 4936	2900	06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4.exe	06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4.exe
PID 4548 set thread context of 4764	4548	server.exe	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4.exeserver.exe

pid	process
2900	06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4.exe
2900	06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4.exe
2900	06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4.exe
4548	server.exe
4548	server.exe
4548	server.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4.exeserver.exeserver.exe

description	pid	process
Token: SeDebugPrivilege	2900	06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4.exe
Token: SeDebugPrivilege	4548	server.exe
Token: SeDebugPrivilege	4764	server.exe
Token: 33	4764	server.exe
Token: SeIncBasePriorityPrivilege	4764	server.exe
Token: 33	4764	server.exe
Token: SeIncBasePriorityPrivilege	4764	server.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4.exe06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4.exeserver.exeserver.exe

description	pid	process	target process
PID 2900 wrote to memory of 4936	2900	06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4.exe	06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4.exe
PID 2900 wrote to memory of 4936	2900	06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4.exe	06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4.exe
PID 2900 wrote to memory of 4936	2900	06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4.exe	06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4.exe
PID 2900 wrote to memory of 4936	2900	06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4.exe	06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4.exe
PID 2900 wrote to memory of 4936	2900	06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4.exe	06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4.exe
PID 4936 wrote to memory of 4548	4936	06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4.exe	server.exe
PID 4936 wrote to memory of 4548	4936	06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4.exe	server.exe
PID 4936 wrote to memory of 4548	4936	06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4.exe	server.exe
PID 4548 wrote to memory of 4764	4548	server.exe	server.exe
PID 4548 wrote to memory of 4764	4548	server.exe	server.exe
PID 4548 wrote to memory of 4764	4548	server.exe	server.exe
PID 4548 wrote to memory of 4764	4548	server.exe	server.exe
PID 4548 wrote to memory of 4764	4548	server.exe	server.exe
PID 4764 wrote to memory of 3400	4764	server.exe	netsh.exe
PID 4764 wrote to memory of 3400	4764	server.exe	netsh.exe
PID 4764 wrote to memory of 3400	4764	server.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4.exe
"C:\Users\Admin\AppData\Local\Temp\06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2900

C:\Users\Admin\AppData\Local\Temp\06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4.exe
C:\Users\Admin\AppData\Local\Temp\06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4.exe
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4936

C:\Users\Admin\AppData\Local\Temp\server.exe
"C:\Users\Admin\AppData\Local\Temp\server.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4548

C:\Users\Admin\AppData\Local\Temp\server.exe
C:\Users\Admin\AppData\Local\Temp\server.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4764

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
5⤵
- Modifies Windows Firewall
PID:3400

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4.exe.log
Filesize
1KB

MD5
3e4397aeafdc36308cf2e69b1a95af46

SHA1
89edb089c6d0f6ff6b3cf7d9b66e24ee6a4cc8dc

SHA256
314c58a3a7be41f6ce4662c67b7adc823cc37923125e61f91f5ec4c6a6760131

SHA512
46251e8d4c02478ddaa42c96be2b7909d215c8608b40b6daef7cd34756709fa95b1a95f02d0c04aa914130ed715a7bd1a1ac43fbfa22477c73639ec57a29898f

Download Submit
C:\Users\Admin\AppData\Local\Temp\server.exe
Filesize
272KB

MD5
3a282cfac08382f2d7375c07940f9928

SHA1
9af13e0087e852d97b677b760f48508f8024079f

SHA256
06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4

SHA512
116f2e8e1016004a4fe2e73695b352ff694ad86ebeabec49ad074356bc0b007e84360bd7bf42f2ca5af158c357a40bd88752e30140d23738c558a6bdc29e3181

Download Submit
C:\Users\Admin\AppData\Local\Temp\server.exe
Filesize
272KB

MD5
3a282cfac08382f2d7375c07940f9928

SHA1
9af13e0087e852d97b677b760f48508f8024079f

SHA256
06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4

SHA512
116f2e8e1016004a4fe2e73695b352ff694ad86ebeabec49ad074356bc0b007e84360bd7bf42f2ca5af158c357a40bd88752e30140d23738c558a6bdc29e3181

Download Submit
C:\Users\Admin\AppData\Local\Temp\server.exe
Filesize
272KB

MD5
3a282cfac08382f2d7375c07940f9928

SHA1
9af13e0087e852d97b677b760f48508f8024079f

SHA256
06e685961d92e151e654ccbbbab4aefd2d3f146fc777cc5009277baa3b7159b4

SHA512
116f2e8e1016004a4fe2e73695b352ff694ad86ebeabec49ad074356bc0b007e84360bd7bf42f2ca5af158c357a40bd88752e30140d23738c558a6bdc29e3181

Download Submit
memory/2900-135-0x0000000008030000-0x000000000803A000-memory.dmp

Filesize
40KB

Download
memory/2900-136-0x000000000A670000-0x000000000A70C000-memory.dmp

Filesize
624KB

Download
memory/2900-132-0x0000000000E40000-0x0000000000E8A000-memory.dmp

Filesize
296KB

Download
memory/2900-134-0x0000000008060000-0x00000000080F2000-memory.dmp

Filesize
584KB

Download
memory/2900-133-0x0000000008570000-0x0000000008B14000-memory.dmp

Filesize
5.6MB

Download
memory/3400-146-0x0000000000000000-mapping.dmp

Download
memory/4548-139-0x0000000000000000-mapping.dmp

Download
memory/4764-143-0x0000000000000000-mapping.dmp

Download
memory/4936-137-0x0000000000000000-mapping.dmp

Download
memory/4936-138-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads