9eb30672961f46f8d28675af6a07dfdd3e07c2ce955ec0f135ead8475195b61e

General

Target

9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe
Size

1.3MB
MD5

1a9f14de010f2c090d00b96aedf324d0
SHA1

9adba3d0a2364f3c620c0f81a34963ed7c6834fe
SHA256

9eb30672961f46f8d28675af6a07dfdd3e07c2ce955ec0f135ead8475195b61e
SHA512

f57220a84f920c546b9cbb71a0055dd295ea3fb03994cccc30927c8640c55797ded4e5008e16699a6eb2521d6be4bc36117e3a2bab59436f9c597a3e457624e0
SSDEEP

6144:PZMFMoMkKpwEZofkObAUQyo9tkLnncEU8tETO8u4qNlQf9HjmaDvTK0lMONbOVrS:vhT3FRTKBO6upHPijWdT

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

microsefto.exe

pid process

3516 microsefto.exe

pid	process
3516	microsefto.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1484 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3328 timeout.exe

pid	process
1484	schtasks.exe

pid	process
3328	timeout.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe

pid	process
2940	9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe
2940	9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe
2940	9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe
2940	9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe
2940	9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe
2940	9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe
2940	9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe
2940	9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe
2940	9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe
2940	9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe
2940	9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe
2940	9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe
2940	9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe
2940	9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe
2940	9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe
2940	9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe
2940	9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe
2940	9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe
2940	9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe
2940	9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe
2940	9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe
2940	9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe
2940	9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exemicrosefto.exe

description pid process

Token: SeDebugPrivilege 2940 9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe
Token: SeDebugPrivilege 3516 microsefto.exe

description	pid	process
Token: SeDebugPrivilege	2940	9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe
Token: SeDebugPrivilege	3516	microsefto.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.execmd.execmd.exe

description	pid	process	target process
PID 2940 wrote to memory of 4368	2940	9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe	cmd.exe
PID 2940 wrote to memory of 4368	2940	9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe	cmd.exe
PID 2940 wrote to memory of 4368	2940	9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe	cmd.exe
PID 2940 wrote to memory of 2016	2940	9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe	cmd.exe
PID 2940 wrote to memory of 2016	2940	9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe	cmd.exe
PID 2940 wrote to memory of 2016	2940	9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe	cmd.exe
PID 4368 wrote to memory of 1484	4368	cmd.exe	schtasks.exe
PID 4368 wrote to memory of 1484	4368	cmd.exe	schtasks.exe
PID 4368 wrote to memory of 1484	4368	cmd.exe	schtasks.exe
PID 2016 wrote to memory of 3328	2016	cmd.exe	timeout.exe
PID 2016 wrote to memory of 3328	2016	cmd.exe	timeout.exe
PID 2016 wrote to memory of 3328	2016	cmd.exe	timeout.exe
PID 2016 wrote to memory of 3516	2016	cmd.exe	microsefto.exe
PID 2016 wrote to memory of 3516	2016	cmd.exe	microsefto.exe
PID 2016 wrote to memory of 3516	2016	cmd.exe	microsefto.exe

C:\Users\Admin\AppData\Local\Temp\9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe
"C:\Users\Admin\AppData\Local\Temp\9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn 9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC /tr '"C:\Users\Admin\AppData\Roaming\microsefto.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4368
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /ru system /rl highest /tn 9EB30672961F46F8D28675AF6A07DFDD3E07C2CE955EC /tr '"C:\Users\Admin\AppData\Roaming\microsefto.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:1484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp721E.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:3328
- - C:\Users\Admin\AppData\Roaming\microsefto.exe
    "C:\Users\Admin\AppData\Roaming\microsefto.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp721E.tmp.bat

Filesize
154B

MD5
67be98e48d1253e54b5db0f8afa9d0a6

SHA1
06de916eeb03958b0e06bcb8040503f9759530c3

SHA256
e8aaca8409f408172484566b061e3f3c97a4d147591a20cbb06408ee9b973ddd

SHA512
d6ea0a9892888801ca84bd0963f3e403144f2a3b2d06cb5291ba410e49466e5f104e353d0096aa209342bb5ac143548c42ffd31d9f69516a13dcfc9f23667c86

Download Submit
C:\Users\Admin\AppData\Roaming\microsefto.exe

Filesize
1.3MB

MD5
1a9f14de010f2c090d00b96aedf324d0

SHA1
9adba3d0a2364f3c620c0f81a34963ed7c6834fe

SHA256
9eb30672961f46f8d28675af6a07dfdd3e07c2ce955ec0f135ead8475195b61e

SHA512
f57220a84f920c546b9cbb71a0055dd295ea3fb03994cccc30927c8640c55797ded4e5008e16699a6eb2521d6be4bc36117e3a2bab59436f9c597a3e457624e0

Download Submit
C:\Users\Admin\AppData\Roaming\microsefto.exe

Filesize
1.3MB

MD5
1a9f14de010f2c090d00b96aedf324d0

SHA1
9adba3d0a2364f3c620c0f81a34963ed7c6834fe

SHA256
9eb30672961f46f8d28675af6a07dfdd3e07c2ce955ec0f135ead8475195b61e

SHA512
f57220a84f920c546b9cbb71a0055dd295ea3fb03994cccc30927c8640c55797ded4e5008e16699a6eb2521d6be4bc36117e3a2bab59436f9c597a3e457624e0

Download Submit
memory/1484-139-0x0000000000000000-mapping.dmp

Download
memory/2016-137-0x0000000000000000-mapping.dmp

Download
memory/2940-133-0x0000000005EA0000-0x0000000006444000-memory.dmp

Filesize
5.6MB

Download
memory/2940-134-0x00000000058F0000-0x0000000005982000-memory.dmp

Filesize
584KB

Download
memory/2940-135-0x0000000005990000-0x0000000005A2C000-memory.dmp

Filesize
624KB

Download
memory/2940-132-0x0000000000F10000-0x0000000001068000-memory.dmp

Filesize
1.3MB

Download
memory/3328-140-0x0000000000000000-mapping.dmp

Download
memory/3516-141-0x0000000000000000-mapping.dmp

Download
memory/3516-144-0x0000000006950000-0x00000000069B6000-memory.dmp

Filesize
408KB

Download
memory/4368-136-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads