901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9

General

Target

901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe
Size

345KB
MD5

e2c77052b14aebb6d5fe7cfe2d7245ea
SHA1

743f660f1b12a8e304ea85db024975a3777d9794
SHA256

901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9
SHA512

efacccd99eb4f196feb99a44179233d46a16d8ba51c07ad3bcaac7a3fd1eaef5f775c2d5aa3b6eacd736d1ac4f5e161d079c8c107359c90d2f543bfa585b45b7
SSDEEP

6144:yCp6Q3Ow9J9HSO7Ktol68AE+0csAfWkrX/Qt+ALbEWe5p/cT:L6Q3BLHLlPzHkfrL/Qt+A835

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\winsvc\\AzCWGv3et05s.exe\",explorer.exe"	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ftdimlhze.exe	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ftdimlhze.exe\DisableExceptionChainValidation	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\adobe = "\"C:\\ProgramData\\svchost\\ftdimlhze.exe\""	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe

Checks for any installed AV software in registry 1 TTPs 2 IoCs

Security Software Discovery

T1063

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\avast! Antivirus	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File created	C:\ProgramData\svchost\desktop.ini	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1444	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe
1444	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe
1444	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe
1444	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1444 set thread context of 1716	1444	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe	27

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1752	schtasks.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\CLSID\{236D86E6-C27F-DE43-BD07-F76A2F940F38}\5E32073F\CG1	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\CLSID	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\CLSID\{236D86E6-C27F-DE43-BD07-F76A2F940F38}\5E32073F\CG1\HAL = 05ee0000	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\CLSID\{236D86E6-C27F-DE43-BD07-F76A2F940F38}\5E32073F\ê' u3	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\CLSID\{236D86E6-C27F-DE43-BD07-F76A2F940F38}\5E32073F\CS1	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\CLSID\{236D86E6-C27F-DE43-BD07-F76A2F940F38}\5E32073F\CW1	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\CLSID\{236D86E6-C27F-DE43-BD07-F76A2F940F38}	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\CLSID\{236D86E6-C27F-DE43-BD07-F76A2F940F38}\5E32073F	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\CLSID\{236D86E6-C27F-DE43-BD07-F76A2F940F38}\5E32073F\ê' u3\BID = 200008001a000b00e6070000140000001a000d0017002700000000005b138263	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\CLSID\{236D86E6-C27F-DE43-BD07-F76A2F940F38}\5E32073F\CW1\1444 = 88000000880600008df1c30758010200	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1444	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe
1444	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe
1444	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1716	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe
1716	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1716	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1444	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe
Token: SeRestorePrivilege	1716	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe
Token: SeBackupPrivilege	1716	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe
Token: SeDebugPrivilege	1716	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 1716	1444	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe	27
PID 1444 wrote to memory of 1716	1444	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe	27
PID 1444 wrote to memory of 1716	1444	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe	27
PID 1444 wrote to memory of 1716	1444	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe	27
PID 1444 wrote to memory of 1716	1444	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe	27
PID 1444 wrote to memory of 1716	1444	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe	27
PID 1444 wrote to memory of 1716	1444	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe	27
PID 1444 wrote to memory of 1716	1444	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe	27
PID 1444 wrote to memory of 1716	1444	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe	27
PID 1444 wrote to memory of 1716	1444	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe	27
PID 1716 wrote to memory of 1752	1716	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe	28
PID 1716 wrote to memory of 1752	1716	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe	28
PID 1716 wrote to memory of 1752	1716	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe	28
PID 1716 wrote to memory of 1752	1716	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe	28
PID 1716 wrote to memory of 1376	1716	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe	30
PID 1716 wrote to memory of 1376	1716	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe	30
PID 1716 wrote to memory of 1376	1716	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe	30
PID 1716 wrote to memory of 1376	1716	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe	30
PID 1716 wrote to memory of 1376	1716	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe	30
PID 1716 wrote to memory of 1376	1716	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe	30
PID 1716 wrote to memory of 1376	1716	901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe	30

C:\Users\Admin\AppData\Local\Temp\901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe
"C:\Users\Admin\AppData\Local\Temp\901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Users\Admin\AppData\Local\Temp\901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe
  "C:\Users\Admin\AppData\Local\Temp\901f242e277472b0f214055410ff8e36fe1385e45b5ff6a628db8a4a6ca00eb9.exe"
  2⤵
  - Sets file execution options in registry
  - Checks for any installed AV software in registry
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: MapViewOfSection
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /CREATE /SC ONLOGON /TN "Windows Update Check - 0x5E32073F" /TR "C:\ProgramData\svchost\ftdimlhze.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1752
- - C:\Windows\SysWOW64\WerFault.exe
    "C:\Windows\SysWOW64\WerFault.exe"
    3⤵
    PID:1376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Winlogon Helper DLL

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

1

T1012

Security Software Discovery

1

T1063

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1376-80-0x0000000000120000-0x00000000001C5000-memory.dmp

Filesize
660KB

Download
memory/1376-79-0x00000000776A0000-0x0000000077821000-memory.dmp

Filesize
1.5MB

Download
memory/1376-76-0x0000000000120000-0x00000000001C5000-memory.dmp

Filesize
660KB

Download
memory/1376-75-0x00000000776A0000-0x0000000077821000-memory.dmp

Filesize
1.5MB

Download
memory/1444-55-0x0000000074850000-0x0000000074DFB000-memory.dmp

Filesize
5.7MB

Download
memory/1444-78-0x0000000000A10000-0x0000000000A1B000-memory.dmp

Filesize
44KB

Download
memory/1444-54-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download
memory/1444-77-0x0000000074850000-0x0000000074DFB000-memory.dmp

Filesize
5.7MB

Download
memory/1716-59-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1716-74-0x00000000001F0000-0x000000000023B000-memory.dmp

Filesize
300KB

Download
memory/1716-69-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1716-70-0x00000000001F0000-0x000000000023B000-memory.dmp

Filesize
300KB

Download
memory/1716-71-0x0000000000340000-0x000000000034B000-memory.dmp

Filesize
44KB

Download
memory/1716-56-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1716-65-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1716-68-0x00000000001F0000-0x000000000023B000-memory.dmp

Filesize
300KB

Download
memory/1716-62-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1716-61-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1716-58-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1716-57-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads