88526185ca16358110ac8db315e39e06a46c03cd294b87a6ad65895a2cf4cd5f

General

Target

88526185ca16358110ac8db315e39e06a46c03cd294b87a6ad65895a2cf4cd5f.exe
Size

978KB
MD5

c784cfcf898645b2018a12ca0c67c93f
SHA1

97a30f8375560c79828106b619ceda10855e8ee7
SHA256

88526185ca16358110ac8db315e39e06a46c03cd294b87a6ad65895a2cf4cd5f
SHA512

807436dce777b67fa11706b1f5bd7852b452f11d57de456750de0ddea36567b497ee5441e8d2dc7db0d456d2a9878c89c8e69f45fd03635de5336e6713e7ec4e
SSDEEP

24576:TI4ttoac2KUJrWdIEdBY1G6FhPgrd7hUjYazvcVXxCp:TI4LoOJrUfNj6zI

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2028	42063722.exe

Deletes itself 1 IoCs

pid	Process
1000	cmd.exe

Loads dropped DLL 5 IoCs

pid	Process
1744	cmd.exe
1744	cmd.exe
2028	42063722.exe
2028	42063722.exe
2028	42063722.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	88526185ca16358110ac8db315e39e06a46c03cd294b87a6ad65895a2cf4cd5f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\42063722 = "C:\\ProgramData\\42063722\\42063722.exe"	88526185ca16358110ac8db315e39e06a46c03cd294b87a6ad65895a2cf4cd5f.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	42063722.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\42063722 = "C:\\PROGRA~3\\42063722\\42063722.exe"	42063722.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2028	42063722.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
2028	42063722.exe
2028	42063722.exe
2028	42063722.exe
2028	42063722.exe
2028	42063722.exe
2028	42063722.exe
2028	42063722.exe
2028	42063722.exe
2028	42063722.exe
2028	42063722.exe
2028	42063722.exe

Suspicious use of SendNotifyMessage 11 IoCs

pid	Process
2028	42063722.exe
2028	42063722.exe
2028	42063722.exe
2028	42063722.exe
2028	42063722.exe
2028	42063722.exe
2028	42063722.exe
2028	42063722.exe
2028	42063722.exe
2028	42063722.exe
2028	42063722.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 1000	864	88526185ca16358110ac8db315e39e06a46c03cd294b87a6ad65895a2cf4cd5f.exe	28
PID 864 wrote to memory of 1000	864	88526185ca16358110ac8db315e39e06a46c03cd294b87a6ad65895a2cf4cd5f.exe	28
PID 864 wrote to memory of 1000	864	88526185ca16358110ac8db315e39e06a46c03cd294b87a6ad65895a2cf4cd5f.exe	28
PID 864 wrote to memory of 1000	864	88526185ca16358110ac8db315e39e06a46c03cd294b87a6ad65895a2cf4cd5f.exe	28
PID 1000 wrote to memory of 1744	1000	cmd.exe	30
PID 1000 wrote to memory of 1744	1000	cmd.exe	30
PID 1000 wrote to memory of 1744	1000	cmd.exe	30
PID 1000 wrote to memory of 1744	1000	cmd.exe	30
PID 1744 wrote to memory of 2028	1744	cmd.exe	31
PID 1744 wrote to memory of 2028	1744	cmd.exe	31
PID 1744 wrote to memory of 2028	1744	cmd.exe	31
PID 1744 wrote to memory of 2028	1744	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\88526185ca16358110ac8db315e39e06a46c03cd294b87a6ad65895a2cf4cd5f.exe
"C:\Users\Admin\AppData\Local\Temp\88526185ca16358110ac8db315e39e06a46c03cd294b87a6ad65895a2cf4cd5f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\ProgramData\42063722\42063722.bat" "
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1000
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start C:\PROGRA~3\42063722\42063722.exe /i
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\PROGRA~3\42063722\42063722.exe
      C:\PROGRA~3\42063722\42063722.exe /i
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:2028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\42063722\42063722.exe

Filesize
978KB

MD5
c784cfcf898645b2018a12ca0c67c93f

SHA1
97a30f8375560c79828106b619ceda10855e8ee7

SHA256
88526185ca16358110ac8db315e39e06a46c03cd294b87a6ad65895a2cf4cd5f

SHA512
807436dce777b67fa11706b1f5bd7852b452f11d57de456750de0ddea36567b497ee5441e8d2dc7db0d456d2a9878c89c8e69f45fd03635de5336e6713e7ec4e

Download Submit
C:\PROGRA~3\42063722\42063722.exe

Filesize
978KB

MD5
c784cfcf898645b2018a12ca0c67c93f

SHA1
97a30f8375560c79828106b619ceda10855e8ee7

SHA256
88526185ca16358110ac8db315e39e06a46c03cd294b87a6ad65895a2cf4cd5f

SHA512
807436dce777b67fa11706b1f5bd7852b452f11d57de456750de0ddea36567b497ee5441e8d2dc7db0d456d2a9878c89c8e69f45fd03635de5336e6713e7ec4e

Download Submit
C:\ProgramData\42063722\42063722.bat

Filesize
230B

MD5
417a60c60d8b7327621c39c9b5637b72

SHA1
7928480738bca42ed43bdfb731cfc71bb1cc2382

SHA256
60dd0e71fe414a4a15c2feceb229aae2d12a17c627fc4c5347add812bd4d9476

SHA512
5f3d298bb0956d6361662a12479930fb02bce848f1f48c03eae6138e17bc9a87a5b910ba974af5510fd82d2b14885086548f87c45fe5de9a2de97cc1d0eacad3

Download Submit
\PROGRA~3\42063722\42063722.exe

Filesize
978KB

MD5
c784cfcf898645b2018a12ca0c67c93f

SHA1
97a30f8375560c79828106b619ceda10855e8ee7

SHA256
88526185ca16358110ac8db315e39e06a46c03cd294b87a6ad65895a2cf4cd5f

SHA512
807436dce777b67fa11706b1f5bd7852b452f11d57de456750de0ddea36567b497ee5441e8d2dc7db0d456d2a9878c89c8e69f45fd03635de5336e6713e7ec4e

Download Submit
\PROGRA~3\42063722\42063722.exe

Filesize
978KB

MD5
c784cfcf898645b2018a12ca0c67c93f

SHA1
97a30f8375560c79828106b619ceda10855e8ee7

SHA256
88526185ca16358110ac8db315e39e06a46c03cd294b87a6ad65895a2cf4cd5f

SHA512
807436dce777b67fa11706b1f5bd7852b452f11d57de456750de0ddea36567b497ee5441e8d2dc7db0d456d2a9878c89c8e69f45fd03635de5336e6713e7ec4e

Download Submit
\PROGRA~3\42063722\42063722.exe

Filesize
978KB

MD5
c784cfcf898645b2018a12ca0c67c93f

SHA1
97a30f8375560c79828106b619ceda10855e8ee7

SHA256
88526185ca16358110ac8db315e39e06a46c03cd294b87a6ad65895a2cf4cd5f

SHA512
807436dce777b67fa11706b1f5bd7852b452f11d57de456750de0ddea36567b497ee5441e8d2dc7db0d456d2a9878c89c8e69f45fd03635de5336e6713e7ec4e

Download Submit
\PROGRA~3\42063722\42063722.exe

Filesize
978KB

MD5
c784cfcf898645b2018a12ca0c67c93f

SHA1
97a30f8375560c79828106b619ceda10855e8ee7

SHA256
88526185ca16358110ac8db315e39e06a46c03cd294b87a6ad65895a2cf4cd5f

SHA512
807436dce777b67fa11706b1f5bd7852b452f11d57de456750de0ddea36567b497ee5441e8d2dc7db0d456d2a9878c89c8e69f45fd03635de5336e6713e7ec4e

Download Submit
\PROGRA~3\42063722\42063722.exe

Filesize
978KB

MD5
c784cfcf898645b2018a12ca0c67c93f

SHA1
97a30f8375560c79828106b619ceda10855e8ee7

SHA256
88526185ca16358110ac8db315e39e06a46c03cd294b87a6ad65895a2cf4cd5f

SHA512
807436dce777b67fa11706b1f5bd7852b452f11d57de456750de0ddea36567b497ee5441e8d2dc7db0d456d2a9878c89c8e69f45fd03635de5336e6713e7ec4e

Download Submit
memory/864-56-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/864-54-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download
memory/864-70-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/2028-67-0x00000000006EB000-0x00000000006ED000-memory.dmp

Filesize
8KB

Download
memory/2028-66-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/2028-72-0x00000000006EB000-0x00000000006ED000-memory.dmp

Filesize
8KB

Download
memory/2028-71-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing