ead919a27338fd4ba333432ded6c5e9a809b5a30e84a51f367a3e4a181b89265

General

Target

ead919a27338fd4ba333432ded6c5e9a809b5a30e84a51f367a3e4a181b89265.exe
Size

87KB
MD5

b903eccccc4ca71152a35aa554bdaecc
SHA1

9a23aad295a80c4783212fc89f52f9d883d53695
SHA256

ead919a27338fd4ba333432ded6c5e9a809b5a30e84a51f367a3e4a181b89265
SHA512

31eb1f405bbb92c0070a898397d0df5820dfe57960c624245580ab06048a0d0ecbf596fe08ee51be0d1a9346a59c9d76c8179121d0628fce08ac0cf6c0701b47
SSDEEP

1536:vQLUbE4gc1Bm+nBKsC0RG+vt9aWn+Lq5Xet4akuRbNhCuckU+YI2/eD09w23emaS:NV31BmoBd9G+vLaWnreChuppcX+YN/eo

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1560	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	ead919a27338fd4ba333432ded6c5e9a809b5a30e84a51f367a3e4a181b89265.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\WINSXS32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ead919a27338fd4ba333432ded6c5e9a809b5a30e84a51f367a3e4a181b89265.exe"	ead919a27338fd4ba333432ded6c5e9a809b5a30e84a51f367a3e4a181b89265.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 968 set thread context of 952	968	ead919a27338fd4ba333432ded6c5e9a809b5a30e84a51f367a3e4a181b89265.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 952	968	ead919a27338fd4ba333432ded6c5e9a809b5a30e84a51f367a3e4a181b89265.exe	28
PID 968 wrote to memory of 952	968	ead919a27338fd4ba333432ded6c5e9a809b5a30e84a51f367a3e4a181b89265.exe	28
PID 968 wrote to memory of 952	968	ead919a27338fd4ba333432ded6c5e9a809b5a30e84a51f367a3e4a181b89265.exe	28
PID 968 wrote to memory of 952	968	ead919a27338fd4ba333432ded6c5e9a809b5a30e84a51f367a3e4a181b89265.exe	28
PID 968 wrote to memory of 952	968	ead919a27338fd4ba333432ded6c5e9a809b5a30e84a51f367a3e4a181b89265.exe	28
PID 968 wrote to memory of 952	968	ead919a27338fd4ba333432ded6c5e9a809b5a30e84a51f367a3e4a181b89265.exe	28
PID 968 wrote to memory of 952	968	ead919a27338fd4ba333432ded6c5e9a809b5a30e84a51f367a3e4a181b89265.exe	28
PID 968 wrote to memory of 952	968	ead919a27338fd4ba333432ded6c5e9a809b5a30e84a51f367a3e4a181b89265.exe	28
PID 968 wrote to memory of 952	968	ead919a27338fd4ba333432ded6c5e9a809b5a30e84a51f367a3e4a181b89265.exe	28
PID 952 wrote to memory of 1560	952	ead919a27338fd4ba333432ded6c5e9a809b5a30e84a51f367a3e4a181b89265.exe	31
PID 952 wrote to memory of 1560	952	ead919a27338fd4ba333432ded6c5e9a809b5a30e84a51f367a3e4a181b89265.exe	31
PID 952 wrote to memory of 1560	952	ead919a27338fd4ba333432ded6c5e9a809b5a30e84a51f367a3e4a181b89265.exe	31
PID 952 wrote to memory of 1560	952	ead919a27338fd4ba333432ded6c5e9a809b5a30e84a51f367a3e4a181b89265.exe	31

C:\Users\Admin\AppData\Local\Temp\ead919a27338fd4ba333432ded6c5e9a809b5a30e84a51f367a3e4a181b89265.exe
"C:\Users\Admin\AppData\Local\Temp\ead919a27338fd4ba333432ded6c5e9a809b5a30e84a51f367a3e4a181b89265.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:968
- C:\Users\Admin\AppData\Local\Temp\ead919a27338fd4ba333432ded6c5e9a809b5a30e84a51f367a3e4a181b89265.exe
  "C:\Users\Admin\AppData\Local\Temp\ead919a27338fd4ba333432ded6c5e9a809b5a30e84a51f367a3e4a181b89265.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\UNI5CB1.tmp.bat" "
    3⤵
    - Deletes itself
    PID:1560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\UNI5CB1.tmp.bat

Filesize
325B

MD5
2a0b304089ecb192d804074108f45950

SHA1
399826542b108e3540064ec2cabc131c0aeac4df

SHA256
b3308703f9e2fc8a6c6fb5eb1935a28bfcbad1083ae3cde7b970b647839faa6b

SHA512
313e831d1ac3331d6420bc1a142cb1d32acf0c7ebfcf82e2ca37dd8f6ea100f2d72ad563ca98e69904b2890077ae5e5bda4e3cc068d8c9a0547095397c7ad799

Download Submit
memory/952-54-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/952-55-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/952-57-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/952-58-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/952-59-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/952-60-0x00000000004016F0-mapping.dmp

Download
memory/952-62-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download
memory/952-63-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/952-64-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1560-65-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing