d7a941a3595fee91376d9da7964288663cb52c0799f6411523c34eaa4e81202c

Analysis

max time kernel
188s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 13:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7a941a3595fee91376d9da7964288663cb52c0799f6411523c34eaa4e81202c.exe
Size

279KB
MD5

38cdf7595bc32087884ad6c3ff81d779
SHA1

f0b1b7b42bbfb7da1bdbe2cb1710ce35d6f42e78
SHA256

d7a941a3595fee91376d9da7964288663cb52c0799f6411523c34eaa4e81202c
SHA512

c20e26a3221850ad2c4b65e7cfa928213889c90bdc32e20c195822ef58b6681e583e7574aa24b8b11a55a031d4468bf6eb4f1c02dafda094bc7965de2e7f79ba
SSDEEP

6144:ye34mcLA8UDYw2vV46P92h1xiu0mSNoMPMOSZLWJSopNVc5d:uLAsw2NhFK1xiu0mwKOvQXd

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3412	kromestudios.exe

Loads dropped DLL 2 IoCs

pid	Process
4752	d7a941a3595fee91376d9da7964288663cb52c0799f6411523c34eaa4e81202c.exe
4752	d7a941a3595fee91376d9da7964288663cb52c0799f6411523c34eaa4e81202c.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	d7a941a3595fee91376d9da7964288663cb52c0799f6411523c34eaa4e81202c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kromestudios = "C:\\Users\\Admin\\AppData\\Roaming\\kromestudios\\kromestudios.exe"	d7a941a3595fee91376d9da7964288663cb52c0799f6411523c34eaa4e81202c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3412	kromestudios.exe
3412	kromestudios.exe
3412	kromestudios.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 3412	4752	d7a941a3595fee91376d9da7964288663cb52c0799f6411523c34eaa4e81202c.exe	82
PID 4752 wrote to memory of 3412	4752	d7a941a3595fee91376d9da7964288663cb52c0799f6411523c34eaa4e81202c.exe	82
PID 4752 wrote to memory of 3412	4752	d7a941a3595fee91376d9da7964288663cb52c0799f6411523c34eaa4e81202c.exe	82
PID 4752 wrote to memory of 4888	4752	d7a941a3595fee91376d9da7964288663cb52c0799f6411523c34eaa4e81202c.exe	83
PID 4752 wrote to memory of 4888	4752	d7a941a3595fee91376d9da7964288663cb52c0799f6411523c34eaa4e81202c.exe	83
PID 4752 wrote to memory of 4888	4752	d7a941a3595fee91376d9da7964288663cb52c0799f6411523c34eaa4e81202c.exe	83

C:\Users\Admin\AppData\Local\Temp\d7a941a3595fee91376d9da7964288663cb52c0799f6411523c34eaa4e81202c.exe
"C:\Users\Admin\AppData\Local\Temp\d7a941a3595fee91376d9da7964288663cb52c0799f6411523c34eaa4e81202c.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Users\Admin\AppData\Roaming\kromestudios\kromestudios.exe
  C:\Users\Admin\AppData\Roaming\kromestudios\kromestudios.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c \DelUS.bat
  2⤵
  PID:4888

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\DelUS.bat

Filesize
264B

MD5
18d94d597a064c19de8c53921b1a853b

SHA1
d77c3c796ba02a3763e8dcd166df8c6f4a5108e2

SHA256
192c83d4f16a5bc87fd7165cde9cf183398f46c7c044ff2c5f7e10e1b51c086f

SHA512
7c54897371271527c643ce7ad6bf612334c55e28c593c3467989c2b282646a31702a8b72868fb4c650e6bf4f1a3e142c3f6595e7864ded1975aa548b19cc59b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu20C7.tmp\LocationCount.dll

Filesize
88KB

MD5
18b0c0f3527164bb56d162c5c79fcbd0

SHA1
f5f20c0eecc9ecfc5953e5d7669e1159e20f223a

SHA256
12e95cc843af092b8a0334159f0979e86a5fd4329504b9050d0b693d4d869c87

SHA512
1f69be481fd9e3be080652d272fd7dff298b806a80a976b86cde08fcfaa9674ee803fb65a4cbc14236d6e459c4f4b711916d07daf5c7793a26f3219b59a8ab2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu20C7.tmp\SelfDelete.dll

Filesize
24KB

MD5
ddc0d6806073a5b034104c88288ca762

SHA1
9663cc10c496f05d6167e19c3920245040e5e431

SHA256
2f4767da9dc7e720d910d32d451674cd08b7892ca753ec5c10b11fe85e12f06b

SHA512
545ca797a397cfcbd9b5d3bd2da2e3219ba7a294e541831655c5763a7f17480fd0b990d0c2e58ba8c71f81d85472b2da6d079b8211b44c40c8c36d21168ec054

Download Submit
C:\Users\Admin\AppData\Roaming\kromestudios\kromestudios.exe

Filesize
380KB

MD5
4422c1483dea8930ef14db0a99c87059

SHA1
1a3d9f8f3d5345027ca71223133d9dbdc006b603

SHA256
a215faae70a31052a91b5da12726a9e23b7e4bae3bb765d8c07699c434559795

SHA512
74447e40504dac30dd6be1768b44182a7f32dd732aa2b2801ce6ba8dfc3361bffce728305189d46f0f67e6e5e0ac3905b774d1da2f6d315f8a5ac74ed3d36ed7

Download Submit
C:\Users\Admin\AppData\Roaming\kromestudios\kromestudios.exe

Filesize
380KB

MD5
4422c1483dea8930ef14db0a99c87059

SHA1
1a3d9f8f3d5345027ca71223133d9dbdc006b603

SHA256
a215faae70a31052a91b5da12726a9e23b7e4bae3bb765d8c07699c434559795

SHA512
74447e40504dac30dd6be1768b44182a7f32dd732aa2b2801ce6ba8dfc3361bffce728305189d46f0f67e6e5e0ac3905b774d1da2f6d315f8a5ac74ed3d36ed7

Download Submit