b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9

General

Target

b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe
Size

349KB
MD5

46dc2c76f068aec1a2c932c6305a5cd1
SHA1

3d3c43218a527ee631f68320b552160adcd5a133
SHA256

b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9
SHA512

b53056dc09042c800b756339fe4db1bf4895bb908b452cc5b9292044eb4d051a8477691f68661084e86ec5e8679f287c1432ddbd4e75c2afedaaea8736ca1a3c
SSDEEP

3072:w7i/Yy7XCQW4rKMXxgT1uwdOQbbUzLWpqx+u:oAKCxgAwnbbUzIu

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 4 IoCs

Processes:

withoutmfidl.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	withoutmfidl.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	withoutmfidl.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	withoutmfidl.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	withoutmfidl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

withoutmfidl.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	withoutmfidl.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	withoutmfidl.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	withoutmfidl.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exeb3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exewithoutmfidl.exewithoutmfidl.exe

pid	process
3860	b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe
3860	b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe
2912	b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe
2912	b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe
2860	withoutmfidl.exe
2860	withoutmfidl.exe
3640	withoutmfidl.exe
3640	withoutmfidl.exe
3640	withoutmfidl.exe
3640	withoutmfidl.exe
3640	withoutmfidl.exe
3640	withoutmfidl.exe
3640	withoutmfidl.exe
3640	withoutmfidl.exe
3640	withoutmfidl.exe
3640	withoutmfidl.exe
3640	withoutmfidl.exe
3640	withoutmfidl.exe
3640	withoutmfidl.exe
3640	withoutmfidl.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe

pid process

2912 b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe

pid	process
2912	b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exewithoutmfidl.exe

description	pid	process	target process
PID 3860 wrote to memory of 2912	3860	b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe	b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe
PID 3860 wrote to memory of 2912	3860	b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe	b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe
PID 3860 wrote to memory of 2912	3860	b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe	b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe
PID 2860 wrote to memory of 3640	2860	withoutmfidl.exe	withoutmfidl.exe
PID 2860 wrote to memory of 3640	2860	withoutmfidl.exe	withoutmfidl.exe
PID 2860 wrote to memory of 3640	2860	withoutmfidl.exe	withoutmfidl.exe

C:\Users\Admin\AppData\Local\Temp\b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe
"C:\Users\Admin\AppData\Local\Temp\b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3860

C:\Users\Admin\AppData\Local\Temp\b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe
"C:\Users\Admin\AppData\Local\Temp\b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2912

C:\Windows\SysWOW64\withoutmfidl.exe
"C:\Windows\SysWOW64\withoutmfidl.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2860

C:\Windows\SysWOW64\withoutmfidl.exe
"C:\Windows\SysWOW64\withoutmfidl.exe"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3640

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2912-134-0x0000000000000000-mapping.dmp

Download
memory/2912-135-0x00000000005B0000-0x00000000005C2000-memory.dmp

Filesize
72KB

Download
memory/2912-136-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2912-138-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2912-141-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3640-139-0x0000000000000000-mapping.dmp

Download
memory/3640-140-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3640-142-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3860-132-0x0000000002060000-0x0000000002072000-memory.dmp

Filesize
72KB

Download
memory/3860-133-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3860-137-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads