0e8756b487f0ad30e1ef88ca6416674471a4ce49fe97f392fc07700a32261fd6

General

Target

0e8756b487f0ad30e1ef88ca6416674471a4ce49fe97f392fc07700a32261fd6.exe
Size

7.6MB
MD5

2f63d10c37c0166cb0ce2ebcbe724a15
SHA1

1f3b8c1806698d04d12698880f49c63ebe810d26
SHA256

0e8756b487f0ad30e1ef88ca6416674471a4ce49fe97f392fc07700a32261fd6
SHA512

8d3935805d00f7118f631408ffeca241a5470740369f0274f59113c09ac78bd5ebbb2e8a69b82315b1709690de73eba3c7c3378256589056e15fb2e869d80e37
SSDEEP

196608:goomt3J786zqI31FLmV0FoGDUnGnW+bRxBP029Lu:bt3JIsd1940FopnGptxN0OL

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1580	303365~1.EXE
480	AUDIOE~1.EXE
4132	is-KAT6O.tmp

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	0e8756b487f0ad30e1ef88ca6416674471a4ce49fe97f392fc07700a32261fd6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	0e8756b487f0ad30e1ef88ca6416674471a4ce49fe97f392fc07700a32261fd6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 1580	4632	0e8756b487f0ad30e1ef88ca6416674471a4ce49fe97f392fc07700a32261fd6.exe	81
PID 4632 wrote to memory of 1580	4632	0e8756b487f0ad30e1ef88ca6416674471a4ce49fe97f392fc07700a32261fd6.exe	81
PID 4632 wrote to memory of 1580	4632	0e8756b487f0ad30e1ef88ca6416674471a4ce49fe97f392fc07700a32261fd6.exe	81
PID 4632 wrote to memory of 480	4632	0e8756b487f0ad30e1ef88ca6416674471a4ce49fe97f392fc07700a32261fd6.exe	84
PID 4632 wrote to memory of 480	4632	0e8756b487f0ad30e1ef88ca6416674471a4ce49fe97f392fc07700a32261fd6.exe	84
PID 4632 wrote to memory of 480	4632	0e8756b487f0ad30e1ef88ca6416674471a4ce49fe97f392fc07700a32261fd6.exe	84
PID 480 wrote to memory of 4132	480	AUDIOE~1.EXE	85
PID 480 wrote to memory of 4132	480	AUDIOE~1.EXE	85
PID 480 wrote to memory of 4132	480	AUDIOE~1.EXE	85

C:\Users\Admin\AppData\Local\Temp\0e8756b487f0ad30e1ef88ca6416674471a4ce49fe97f392fc07700a32261fd6.exe
"C:\Users\Admin\AppData\Local\Temp\0e8756b487f0ad30e1ef88ca6416674471a4ce49fe97f392fc07700a32261fd6.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\303365~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\303365~1.EXE
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AUDIOE~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AUDIOE~1.EXE
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:480
- - C:\Users\Admin\AppData\Local\Temp\is-MU9BI.tmp\is-KAT6O.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-MU9BI.tmp\is-KAT6O.tmp" /SL4 $170068 "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AUDIOE~1.EXE" 7551404 52224
    3⤵
    - Executes dropped EXE
    PID:4132

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\303365~1.EXE

Filesize
129KB

MD5
e6bc849721807658954ed15bc10f1860

SHA1
a0d7d952b0f5a012e0bbdee0ebae6d7fd996ac7f

SHA256
55045b6382b197528eb6591b15de5c7dd933bab84d0c2d4cc616aeda800af32e

SHA512
bb02eae101d989bde9e897dc0c7e598e218ffa9ec7fa9fbfbc9440beac3efe5aebccf4ea9bbd70864795d32d43e658cbe35b1d36b36c0a426678312b40e7d106

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\303365~1.EXE

Filesize
129KB

MD5
e6bc849721807658954ed15bc10f1860

SHA1
a0d7d952b0f5a012e0bbdee0ebae6d7fd996ac7f

SHA256
55045b6382b197528eb6591b15de5c7dd933bab84d0c2d4cc616aeda800af32e

SHA512
bb02eae101d989bde9e897dc0c7e598e218ffa9ec7fa9fbfbc9440beac3efe5aebccf4ea9bbd70864795d32d43e658cbe35b1d36b36c0a426678312b40e7d106

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AUDIOE~1.EXE

Filesize
7.5MB

MD5
39591469f4210abf023e0aebfe6da534

SHA1
fefbe6920438c99c3b554024d562df9db9c4f3a5

SHA256
8b6501b4af26d5e037800d8a6c676f5ea3bceb85b410d0b748431fcdfe1e62c5

SHA512
633c748603e9c7ebd8fa5c892f6ddf0776dc3f60450a522520112de91b5af405004426b3554caf735f76fb62c827e5b0f3ec29b84051f8ba5b1ed4aecd74592f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AUDIOE~1.EXE

Filesize
7.5MB

MD5
39591469f4210abf023e0aebfe6da534

SHA1
fefbe6920438c99c3b554024d562df9db9c4f3a5

SHA256
8b6501b4af26d5e037800d8a6c676f5ea3bceb85b410d0b748431fcdfe1e62c5

SHA512
633c748603e9c7ebd8fa5c892f6ddf0776dc3f60450a522520112de91b5af405004426b3554caf735f76fb62c827e5b0f3ec29b84051f8ba5b1ed4aecd74592f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MU9BI.tmp\is-KAT6O.tmp

Filesize
643KB

MD5
036ef63e2f9b138a42d6adb54ec0cd1e

SHA1
353db5d438205a726a6d54beb62f9c62638f501d

SHA256
71b487f0523f213004766402b22bf86fa0ef9891e940d2a4cb12eba6627e7cc6

SHA512
31b8f6e76c8c4f5323f12384c41f6f2b04e58545c121da71e2a4da947a9c0aea9eb05df4f8199cc6dc89bc238577c4e2d5fb4b66e77e1130bc72b6c38f207cc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MU9BI.tmp\is-KAT6O.tmp

Filesize
643KB

MD5
036ef63e2f9b138a42d6adb54ec0cd1e

SHA1
353db5d438205a726a6d54beb62f9c62638f501d

SHA256
71b487f0523f213004766402b22bf86fa0ef9891e940d2a4cb12eba6627e7cc6

SHA512
31b8f6e76c8c4f5323f12384c41f6f2b04e58545c121da71e2a4da947a9c0aea9eb05df4f8199cc6dc89bc238577c4e2d5fb4b66e77e1130bc72b6c38f207cc9

Download Submit
memory/480-145-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/480-150-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1580-141-0x0000000000510000-0x000000000052E000-memory.dmp

Filesize
120KB

Download
memory/1580-137-0x0000000000510000-0x000000000052E000-memory.dmp

Filesize
120KB

Download
memory/1580-135-0x0000000003140000-0x0000000003161000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing