0b584fcc0cc05972800509c4e2ac0968512b4cd70106f4aa77fb0ac221a3a2d8

General

Target

0b584fcc0cc05972800509c4e2ac0968512b4cd70106f4aa77fb0ac221a3a2d8.exe
Size

387KB
MD5

f18a5f7d163bf492b1c07a5eacea6753
SHA1

4a0fdabb151b8093a9f7a3ff8191961db0685031
SHA256

0b584fcc0cc05972800509c4e2ac0968512b4cd70106f4aa77fb0ac221a3a2d8
SHA512

bbb31e42a918ffa376c3c046ee7e857d89f524d7545f10ce9e8e46f0fdf973f0f0df26093ce6e7464a7699922f569578d935bc438e3dbe1aa75c6d2494f51d7a
SSDEEP

6144:y3MDzqEt6GSQOy4hzEqE8imE1oOOXv0uYm2nrjw:y30q2S4mcz1xO9Ymejw

Score

8^/10

evasion persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

hack2.exeTrojan.exe

pid process

980 hack2.exe
3620 Trojan.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

4920 netsh.exe

pid	process
4920	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0b584fcc0cc05972800509c4e2ac0968512b4cd70106f4aa77fb0ac221a3a2d8.exehack2.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	0b584fcc0cc05972800509c4e2ac0968512b4cd70106f4aa77fb0ac221a3a2d8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	hack2.exe

Drops startup file 2 IoCs

Processes:

Trojan.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe	Trojan.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe	Trojan.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Trojan.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .."	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .."	Trojan.exe

Drops file in Windows directory 2 IoCs

Processes:

hack2.exe

description	ioc	process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	hack2.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	hack2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

hack2.exeTrojan.exe

pid	process
980	hack2.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe
3620	Trojan.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

hack2.exeTrojan.exe

description pid process

Token: SeDebugPrivilege 980 hack2.exe
Token: SeDebugPrivilege 3620 Trojan.exe

description	pid	process
Token: SeDebugPrivilege	980	hack2.exe
Token: SeDebugPrivilege	3620	Trojan.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

0b584fcc0cc05972800509c4e2ac0968512b4cd70106f4aa77fb0ac221a3a2d8.exehack2.exeTrojan.exe

description	pid	process	target process
PID 4752 wrote to memory of 980	4752	0b584fcc0cc05972800509c4e2ac0968512b4cd70106f4aa77fb0ac221a3a2d8.exe	hack2.exe
PID 4752 wrote to memory of 980	4752	0b584fcc0cc05972800509c4e2ac0968512b4cd70106f4aa77fb0ac221a3a2d8.exe	hack2.exe
PID 4752 wrote to memory of 980	4752	0b584fcc0cc05972800509c4e2ac0968512b4cd70106f4aa77fb0ac221a3a2d8.exe	hack2.exe
PID 980 wrote to memory of 3620	980	hack2.exe	Trojan.exe
PID 980 wrote to memory of 3620	980	hack2.exe	Trojan.exe
PID 980 wrote to memory of 3620	980	hack2.exe	Trojan.exe
PID 3620 wrote to memory of 4920	3620	Trojan.exe	netsh.exe
PID 3620 wrote to memory of 4920	3620	Trojan.exe	netsh.exe
PID 3620 wrote to memory of 4920	3620	Trojan.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\0b584fcc0cc05972800509c4e2ac0968512b4cd70106f4aa77fb0ac221a3a2d8.exe
"C:\Users\Admin\AppData\Local\Temp\0b584fcc0cc05972800509c4e2ac0968512b4cd70106f4aa77fb0ac221a3a2d8.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4752

C:\Users\Admin\AppData\Local\Temp\hack2.exe
"C:\Users\Admin\AppData\Local\Temp\hack2.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:980

C:\Users\Admin\AppData\Local\Temp\Trojan.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"
3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3620

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE
4⤵
- Modifies Windows Firewall
PID:4920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Trojan.exe
Filesize
171KB

MD5
183565210ae0be0a54e98ed649320c5c

SHA1
99014e64070fd77bfc84432d3299564c72511474

SHA256
94543c222beb9fcb300469111df4ecbaee627e81e92c8d406f569559f30b5a4b

SHA512
fd077d03bfab8d0642f0a8d79140838ee98a1628845497e004e5e9f1304a69e501db9b2328681995278ea4df218c41999005317954d7c9dd7d63d98c8e38477e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Trojan.exe
Filesize
171KB

MD5
183565210ae0be0a54e98ed649320c5c

SHA1
99014e64070fd77bfc84432d3299564c72511474

SHA256
94543c222beb9fcb300469111df4ecbaee627e81e92c8d406f569559f30b5a4b

SHA512
fd077d03bfab8d0642f0a8d79140838ee98a1628845497e004e5e9f1304a69e501db9b2328681995278ea4df218c41999005317954d7c9dd7d63d98c8e38477e

Download Submit
C:\Users\Admin\AppData\Local\Temp\hack2.exe
Filesize
171KB

MD5
183565210ae0be0a54e98ed649320c5c

SHA1
99014e64070fd77bfc84432d3299564c72511474

SHA256
94543c222beb9fcb300469111df4ecbaee627e81e92c8d406f569559f30b5a4b

SHA512
fd077d03bfab8d0642f0a8d79140838ee98a1628845497e004e5e9f1304a69e501db9b2328681995278ea4df218c41999005317954d7c9dd7d63d98c8e38477e

Download Submit
C:\Users\Admin\AppData\Local\Temp\hack2.exe
Filesize
171KB

MD5
183565210ae0be0a54e98ed649320c5c

SHA1
99014e64070fd77bfc84432d3299564c72511474

SHA256
94543c222beb9fcb300469111df4ecbaee627e81e92c8d406f569559f30b5a4b

SHA512
fd077d03bfab8d0642f0a8d79140838ee98a1628845497e004e5e9f1304a69e501db9b2328681995278ea4df218c41999005317954d7c9dd7d63d98c8e38477e

Download Submit
memory/980-135-0x00000000753C0000-0x0000000075971000-memory.dmp

Filesize
5.7MB

Download
memory/980-132-0x0000000000000000-mapping.dmp

Download
memory/980-139-0x00000000753C0000-0x0000000075971000-memory.dmp

Filesize
5.7MB

Download
memory/3620-136-0x0000000000000000-mapping.dmp

Download
memory/3620-140-0x00000000753C0000-0x0000000075971000-memory.dmp

Filesize
5.7MB

Download
memory/3620-141-0x00000000753C0000-0x0000000075971000-memory.dmp

Filesize
5.7MB

Download
memory/3620-143-0x0000000000C69000-0x0000000000C6F000-memory.dmp

Filesize
24KB

Download
memory/3620-144-0x0000000000C69000-0x0000000000C6F000-memory.dmp

Filesize
24KB

Download
memory/3620-145-0x00000000087A0000-0x00000000087A4000-memory.dmp

Filesize
16KB

Download
memory/3620-146-0x00000000087A0000-0x00000000087A4000-memory.dmp

Filesize
16KB

Download
memory/4920-142-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads