65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a

General

Target

65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe
Size

129KB
MD5

1efd85caf5731f48ff2cb1106de1e7e0
SHA1

9af53408c8910a78e007ed724eab37f580afc24f
SHA256

65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a
SHA512

cd2b55836223c1beffd7ea375a5a18b233c5259d4092ccf6dfce689d1aefbfa7feda398e28756e49cb9772bb59fb77c685b542f8059fa1dfc2572f4a1d5e7a3b
SSDEEP

3072:PgXdZt9P6D3XJ4lpgt5/KQwL4Wfd4yqRddQ5paMJqJQ24q5paMr:Pe34qlpgt5/KB7VMRdW5pLJJy5pLr

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4804	interplex.exe

Loads dropped DLL 2 IoCs

pid	Process
4076	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe
4076	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\interplex = "C:\\Users\\Admin\\AppData\\Roaming\\interplex\\interplex.exe"	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\interplex.ini	interplex.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2952	SCHTASKS.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4804	interplex.exe
4804	interplex.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 2952	4076	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe	80
PID 4076 wrote to memory of 2952	4076	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe	80
PID 4076 wrote to memory of 2952	4076	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe	80
PID 4076 wrote to memory of 4804	4076	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe	82
PID 4076 wrote to memory of 4804	4076	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe	82
PID 4076 wrote to memory of 4804	4076	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe	82
PID 4076 wrote to memory of 4872	4076	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe	85
PID 4076 wrote to memory of 4872	4076	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe	85
PID 4076 wrote to memory of 4872	4076	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe	85

C:\Users\Admin\AppData\Local\Temp\65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe
"C:\Users\Admin\AppData\Local\Temp\65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\SysWOW64\SCHTASKS.exe
  SCHTASKS /Create /F /TN interplex /sc ONLOGON /TR "C:\Users\Admin\AppData\Roaming\interplex\interplex.exe" /RL HIGHEST
  2⤵
  - Creates scheduled task(s)
  PID:2952
- C:\Users\Admin\AppData\Roaming\interplex\interplex.exe
  C:\Users\Admin\AppData\Roaming\interplex\interplex.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:4804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c \DelUS.bat
  2⤵
  PID:4872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\DelUS.bat

Filesize
264B

MD5
e23c673918c2c936da9176fab33cd2b5

SHA1
0edb9b514f0f7e1797900ab1b26b712c9d093a02

SHA256
f1db549428c4175a8c824b539cc799dd29e81966aaf097c1058039c3e44bea65

SHA512
683133a7471b748dcf455c7b82a7a6564eca4c2e433832e4afaf4b4325f5411c54acf5e05f546c11fe3e1ec4ed094f5b8e6a33c4bebc06ab409042d69383c53b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx9AEE.tmp\SelfDelete.dll

Filesize
24KB

MD5
7bf1bd7661385621c7908e36958f582e

SHA1
43242d7731c097e95fb96753c8262609ff929410

SHA256
c0ad2c13d48c9fe62f898da822a5f08be3bf6c4e2c1c7ffdf7634f2ca4a8859e

SHA512
8317af5cc3ac802eb095f3fa8cc71daa1265ca58fead031c07872f3d4bb07663a7002ae734fad392a7617f0923fe0caf1f54ed55afdf8516a6a08e202d86fa7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx9AEE.tmp\nsExec.dll

Filesize
6KB

MD5
cdff6b8f9523b6ef9f20fb5f9e90f1a5

SHA1
b25f6e0a19b41ff0a12de8e98e3005bc119d34fa

SHA256
80b2740fb3a21ffab022a96ce6b420019072f8ef3a048fd9dea4a5b64498c0c8

SHA512
62585c6a6103aed10f9a79c016df8cb630c3e37715542b5f26aa1a910771540c9b323ddbba3329db0ecf524143f7a27b782e198ce944317f764be6b9d04b792e

Download Submit
C:\Users\Admin\AppData\Roaming\interplex\InterPlex.exe

Filesize
386KB

MD5
e4da98a0f32c3c18abf062b3f62ed361

SHA1
4a3c54409345a31ab90cec95f69d81fb9fa06d17

SHA256
5c7a7f2edbcd5c69715c4f98f34063aabc394f716b1a77a6e1508a9ec4016e87

SHA512
a4fd5b462c7ddcb69b079da162352dca2d7d9ffafd4977e2cfbce6634eb9782803ea66581eb2aa06c76cdd5980c9dcbecf7344ccbed55cf03fae17f5805d0b0d

Download Submit
C:\Users\Admin\AppData\Roaming\interplex\interplex.exe

Filesize
386KB

MD5
e4da98a0f32c3c18abf062b3f62ed361

SHA1
4a3c54409345a31ab90cec95f69d81fb9fa06d17

SHA256
5c7a7f2edbcd5c69715c4f98f34063aabc394f716b1a77a6e1508a9ec4016e87

SHA512
a4fd5b462c7ddcb69b079da162352dca2d7d9ffafd4977e2cfbce6634eb9782803ea66581eb2aa06c76cdd5980c9dcbecf7344ccbed55cf03fae17f5805d0b0d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads