a37a4870198995e53d76c72b1cfc9b7253ba05cffdc984c50b795712ee72a68f

General

Target

a37a4870198995e53d76c72b1cfc9b7253ba05cffdc984c50b795712ee72a68f.exe
Size

788KB
MD5

6323cc77aa6e15674f921e7b8f28a559
SHA1

dbb734bef0d02e5f30b6257fbf97556c389df50c
SHA256

a37a4870198995e53d76c72b1cfc9b7253ba05cffdc984c50b795712ee72a68f
SHA512

43a61b4d54028d812ca4e3f5566764609e27ae2efeeeeccb7f3790119234a1aa1b0f57635088469ceadf44f0812266f7207a1615bde29d7f2acdd3584403af7f
SSDEEP

24576:ZBs6ZFH2p+hY3SJKZUSh8wV1EzoVI5PZm42eBX5/RTl:ZC6IvPZUSh8wV1EzoVOZm42C5/

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1744	Setup.exe

Loads dropped DLL 1 IoCs

pid	Process
1644	a37a4870198995e53d76c72b1cfc9b7253ba05cffdc984c50b795712ee72a68f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND\Setup.exe = "0"	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS\Setup.exe = "1"	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Setup.exe = "0"	Setup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1744	1644	a37a4870198995e53d76c72b1cfc9b7253ba05cffdc984c50b795712ee72a68f.exe	28
PID 1644 wrote to memory of 1744	1644	a37a4870198995e53d76c72b1cfc9b7253ba05cffdc984c50b795712ee72a68f.exe	28
PID 1644 wrote to memory of 1744	1644	a37a4870198995e53d76c72b1cfc9b7253ba05cffdc984c50b795712ee72a68f.exe	28
PID 1644 wrote to memory of 1744	1644	a37a4870198995e53d76c72b1cfc9b7253ba05cffdc984c50b795712ee72a68f.exe	28
PID 1644 wrote to memory of 1744	1644	a37a4870198995e53d76c72b1cfc9b7253ba05cffdc984c50b795712ee72a68f.exe	28
PID 1644 wrote to memory of 1744	1644	a37a4870198995e53d76c72b1cfc9b7253ba05cffdc984c50b795712ee72a68f.exe	28
PID 1644 wrote to memory of 1744	1644	a37a4870198995e53d76c72b1cfc9b7253ba05cffdc984c50b795712ee72a68f.exe	28

C:\Users\Admin\AppData\Local\Temp\a37a4870198995e53d76c72b1cfc9b7253ba05cffdc984c50b795712ee72a68f.exe
"C:\Users\Admin\AppData\Local\Temp\a37a4870198995e53d76c72b1cfc9b7253ba05cffdc984c50b795712ee72a68f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Users\Admin\AppData\Local\Temp\a2WEah3iHS\3mrviWg6\Setup.exe
  C:\Users\Admin\AppData\Local\Temp\a2WEah3iHS\3mrviWg6\Setup.exe --relaunch
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  PID:1744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a2WEah3iHS\3mrviWg6\Setup.exe

Filesize
788KB

MD5
6323cc77aa6e15674f921e7b8f28a559

SHA1
dbb734bef0d02e5f30b6257fbf97556c389df50c

SHA256
a37a4870198995e53d76c72b1cfc9b7253ba05cffdc984c50b795712ee72a68f

SHA512
43a61b4d54028d812ca4e3f5566764609e27ae2efeeeeccb7f3790119234a1aa1b0f57635088469ceadf44f0812266f7207a1615bde29d7f2acdd3584403af7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\a2WEah3iHS\3mrviWg6\Setup.exe

Filesize
788KB

MD5
6323cc77aa6e15674f921e7b8f28a559

SHA1
dbb734bef0d02e5f30b6257fbf97556c389df50c

SHA256
a37a4870198995e53d76c72b1cfc9b7253ba05cffdc984c50b795712ee72a68f

SHA512
43a61b4d54028d812ca4e3f5566764609e27ae2efeeeeccb7f3790119234a1aa1b0f57635088469ceadf44f0812266f7207a1615bde29d7f2acdd3584403af7f

Download Submit
\Users\Admin\AppData\Local\Temp\a2WEah3iHS\3mrviWg6\Setup.exe

Filesize
788KB

MD5
6323cc77aa6e15674f921e7b8f28a559

SHA1
dbb734bef0d02e5f30b6257fbf97556c389df50c

SHA256
a37a4870198995e53d76c72b1cfc9b7253ba05cffdc984c50b795712ee72a68f

SHA512
43a61b4d54028d812ca4e3f5566764609e27ae2efeeeeccb7f3790119234a1aa1b0f57635088469ceadf44f0812266f7207a1615bde29d7f2acdd3584403af7f

Download Submit
memory/1644-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing