c8c8748e69afd44d5f085c90268f3d0512d70c623114282f425613ec1e8089bb

Analysis

max time kernel
153s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 17:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8c8748e69afd44d5f085c90268f3d0512d70c623114282f425613ec1e8089bb.exe
Size

457KB
MD5

5f27a3938a9d75b06cd477e6c4e0c5ef
SHA1

69228580b68b2e1880e7d2e263e681d1ecad2870
SHA256

c8c8748e69afd44d5f085c90268f3d0512d70c623114282f425613ec1e8089bb
SHA512

14747c38694b27d454d99ec8f8aebf68ca5dd1f8344ef1acb5108538e4457ef7bdfe3f01c5bd494c3b8a9227094a4f0596e40b43b0634582b3f9bb1446d2bfa9
SSDEEP

12288:Ygth6+AiF347KN6ERuDCbcuSa14vlncjvrnhY4Ee:mI3kPa1gd8vri4

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~3\pSC8UxjQYj5521xe	pSC8UxjQYj5521xe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	pSC8UxjQYj5521xe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Use FormSuggest = "Yes"	pSC8UxjQYj5521xe.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
736	c8c8748e69afd44d5f085c90268f3d0512d70c623114282f425613ec1e8089bb.exe
736	c8c8748e69afd44d5f085c90268f3d0512d70c623114282f425613ec1e8089bb.exe
736	c8c8748e69afd44d5f085c90268f3d0512d70c623114282f425613ec1e8089bb.exe
736	c8c8748e69afd44d5f085c90268f3d0512d70c623114282f425613ec1e8089bb.exe
3404	pSC8UxjQYj5521xe.exe
3404	pSC8UxjQYj5521xe.exe
3404	pSC8UxjQYj5521xe.exe
3404	pSC8UxjQYj5521xe.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
736	c8c8748e69afd44d5f085c90268f3d0512d70c623114282f425613ec1e8089bb.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3404	pSC8UxjQYj5521xe.exe
3404	pSC8UxjQYj5521xe.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3404	pSC8UxjQYj5521xe.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
736	c8c8748e69afd44d5f085c90268f3d0512d70c623114282f425613ec1e8089bb.exe
3404	pSC8UxjQYj5521xe.exe
3404	pSC8UxjQYj5521xe.exe
3404	pSC8UxjQYj5521xe.exe
3404	pSC8UxjQYj5521xe.exe
3404	pSC8UxjQYj5521xe.exe
3404	pSC8UxjQYj5521xe.exe
3404	pSC8UxjQYj5521xe.exe
3404	pSC8UxjQYj5521xe.exe
3404	pSC8UxjQYj5521xe.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 736 wrote to memory of 3404	736	c8c8748e69afd44d5f085c90268f3d0512d70c623114282f425613ec1e8089bb.exe	79
PID 736 wrote to memory of 3404	736	c8c8748e69afd44d5f085c90268f3d0512d70c623114282f425613ec1e8089bb.exe	79
PID 736 wrote to memory of 3404	736	c8c8748e69afd44d5f085c90268f3d0512d70c623114282f425613ec1e8089bb.exe	79

C:\Users\Admin\AppData\Local\Temp\c8c8748e69afd44d5f085c90268f3d0512d70c623114282f425613ec1e8089bb.exe
"C:\Users\Admin\AppData\Local\Temp\c8c8748e69afd44d5f085c90268f3d0512d70c623114282f425613ec1e8089bb.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:736
- C:\PROGRA~3\pSC8UxjQYj5521xe.exe
  C:\PROGRA~3\pSC8UxjQYj5521xe.exe
  2⤵
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3404

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/736-132-0x00000000025D0000-0x0000000002770000-memory.dmp

Filesize
1.6MB

Download
memory/736-133-0x0000000000400000-0x00000000006D3000-memory.dmp

Filesize
2.8MB

Download
memory/736-135-0x0000000000400000-0x00000000006D3000-memory.dmp

Filesize
2.8MB

Download
memory/3404-136-0x0000000000400000-0x00000000006D3000-memory.dmp

Filesize
2.8MB

Download
memory/3404-137-0x0000000000400000-0x00000000006D3000-memory.dmp

Filesize
2.8MB

Download