868dd2a9951551d7fe63325b30965ccfdeafdfb1195a6f281a88e16e5627577b

General

Target

868dd2a9951551d7fe63325b30965ccfdeafdfb1195a6f281a88e16e5627577b.exe
Size

962KB
MD5

3795fac3c799e761a4a20db143482909
SHA1

5e67c9920661f537813703701b032904ee747143
SHA256

868dd2a9951551d7fe63325b30965ccfdeafdfb1195a6f281a88e16e5627577b
SHA512

a1dcdbc203dab26ff88115e4044e15051a4788f95077c0c1434dff144fd61a7750c1fd30c5917a2078676ae4e5feae0654645326e6ec4ecd547b27c089831644
SSDEEP

24576:P0wwuFQZfpcYRzooiPjAUMhZfWN+Rntqv48KvQZiRr:cwwiOBmUUMhZeN+dtBtSYr

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	868dd2a9951551d7fe63325b30965ccfdeafdfb1195a6f281a88e16e5627577b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HomePage = "C:\\Windows\\svchostsx.exe"	868dd2a9951551d7fe63325b30965ccfdeafdfb1195a6f281a88e16e5627577b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 960 set thread context of 752	960	868dd2a9951551d7fe63325b30965ccfdeafdfb1195a6f281a88e16e5627577b.exe	79

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\868dd2a9951551d7fe63325b30965ccfdeafdfb1195a6f281a88e16e5627577b.exe	868dd2a9951551d7fe63325b30965ccfdeafdfb1195a6f281a88e16e5627577b.exe
File opened for modification	C:\Windows\868dd2a9951551d7fe63325b30965ccfdeafdfb1195a6f281a88e16e5627577b.exe	868dd2a9951551d7fe63325b30965ccfdeafdfb1195a6f281a88e16e5627577b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.kopukarama.com/ara"	868dd2a9951551d7fe63325b30965ccfdeafdfb1195a6f281a88e16e5627577b.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
752	868dd2a9951551d7fe63325b30965ccfdeafdfb1195a6f281a88e16e5627577b.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
960	868dd2a9951551d7fe63325b30965ccfdeafdfb1195a6f281a88e16e5627577b.exe
960	868dd2a9951551d7fe63325b30965ccfdeafdfb1195a6f281a88e16e5627577b.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 752	960	868dd2a9951551d7fe63325b30965ccfdeafdfb1195a6f281a88e16e5627577b.exe	79
PID 960 wrote to memory of 752	960	868dd2a9951551d7fe63325b30965ccfdeafdfb1195a6f281a88e16e5627577b.exe	79
PID 960 wrote to memory of 752	960	868dd2a9951551d7fe63325b30965ccfdeafdfb1195a6f281a88e16e5627577b.exe	79
PID 960 wrote to memory of 752	960	868dd2a9951551d7fe63325b30965ccfdeafdfb1195a6f281a88e16e5627577b.exe	79
PID 960 wrote to memory of 752	960	868dd2a9951551d7fe63325b30965ccfdeafdfb1195a6f281a88e16e5627577b.exe	79
PID 960 wrote to memory of 752	960	868dd2a9951551d7fe63325b30965ccfdeafdfb1195a6f281a88e16e5627577b.exe	79
PID 960 wrote to memory of 752	960	868dd2a9951551d7fe63325b30965ccfdeafdfb1195a6f281a88e16e5627577b.exe	79
PID 960 wrote to memory of 752	960	868dd2a9951551d7fe63325b30965ccfdeafdfb1195a6f281a88e16e5627577b.exe	79
PID 960 wrote to memory of 752	960	868dd2a9951551d7fe63325b30965ccfdeafdfb1195a6f281a88e16e5627577b.exe	79
PID 960 wrote to memory of 752	960	868dd2a9951551d7fe63325b30965ccfdeafdfb1195a6f281a88e16e5627577b.exe	79
PID 960 wrote to memory of 752	960	868dd2a9951551d7fe63325b30965ccfdeafdfb1195a6f281a88e16e5627577b.exe	79
PID 960 wrote to memory of 752	960	868dd2a9951551d7fe63325b30965ccfdeafdfb1195a6f281a88e16e5627577b.exe	79
PID 960 wrote to memory of 752	960	868dd2a9951551d7fe63325b30965ccfdeafdfb1195a6f281a88e16e5627577b.exe	79

C:\Users\Admin\AppData\Local\Temp\868dd2a9951551d7fe63325b30965ccfdeafdfb1195a6f281a88e16e5627577b.exe
"C:\Users\Admin\AppData\Local\Temp\868dd2a9951551d7fe63325b30965ccfdeafdfb1195a6f281a88e16e5627577b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:960
- C:\Users\Admin\AppData\Local\Temp\868dd2a9951551d7fe63325b30965ccfdeafdfb1195a6f281a88e16e5627577b.exe
  C:\Users\Admin\AppData\Local\Temp\868dd2a9951551d7fe63325b30965ccfdeafdfb1195a6f281a88e16e5627577b.exe
  2⤵
  - Adds Run key to start application
  - Drops file in Windows directory
  - Modifies Internet Explorer start page
  - Suspicious use of FindShellTrayWindow
  PID:752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/752-136-0x0000000000000000-mapping.dmp

Download
memory/752-137-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/752-138-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/752-139-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/752-141-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/752-143-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/960-132-0x0000000000400000-0x0000000000744000-memory.dmp

Filesize
3.3MB

Download
memory/960-133-0x0000000000400000-0x0000000000744000-memory.dmp

Filesize
3.3MB

Download
memory/960-140-0x0000000000400000-0x0000000000744000-memory.dmp

Filesize
3.3MB

Download
memory/960-142-0x0000000000400000-0x0000000000744000-memory.dmp

Filesize
3.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads