85f2c3eef0238b6d115b4b83e0fec9a060673e05aeeaacea4ad98a7fec07cee6

General

Target

85f2c3eef0238b6d115b4b83e0fec9a060673e05aeeaacea4ad98a7fec07cee6.exe
Size

853KB
MD5

a16276fd9584f97ce12cb7aaa205d7d6
SHA1

727e421d4494480f53e0c8857187ab7d4ce03e6a
SHA256

85f2c3eef0238b6d115b4b83e0fec9a060673e05aeeaacea4ad98a7fec07cee6
SHA512

62f92b27f72c07a14b41f0c8a7ce0599caaa7ca520a79b7f661d015baa1f3e045dae36c174589a82410ab1388a533fb9667ae360dd9deaacb9882d8c345060fb
SSDEEP

24576:/x99rqke6DqEJnl3GSJw8JRYWPQoXsBA9fhj:/xjrDe6Dq2w83YWYqVl

Score

8^/10

evasion persistence

Malware Config

Signatures

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	85f2c3eef0238b6d115b4b83e0fec9a060673e05aeeaacea4ad98a7fec07cee6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regsvr32.exe

Disables Task Manager via registry modification
evasion

Executes dropped EXE 1 IoCs

pid	Process
1716	regsvr32.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{7M8A6G00-3I18-11C0-821H-444200140P0S}	85f2c3eef0238b6d115b4b83e0fec9a060673e05aeeaacea4ad98a7fec07cee6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7M8A6G00-3I18-11C0-821H-444200140P0S}\StubPath = "C:\\Windows\\system32\\OLE32Init.exe"	85f2c3eef0238b6d115b4b83e0fec9a060673e05aeeaacea4ad98a7fec07cee6.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{7M8A6G00-3I18-11C0-821H-444200140P0S}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7M8A6G00-3I18-11C0-821H-444200140P0S}\StubPath = "C:\\Windows\\system32\\OLE32Init.exe"	regsvr32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\OLE32Init.exe	85f2c3eef0238b6d115b4b83e0fec9a060673e05aeeaacea4ad98a7fec07cee6.exe
File created	C:\Windows\SysWOW64\OLE32Init.exe	85f2c3eef0238b6d115b4b83e0fec9a060673e05aeeaacea4ad98a7fec07cee6.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\regsvr32.exe	85f2c3eef0238b6d115b4b83e0fec9a060673e05aeeaacea4ad98a7fec07cee6.exe
File created	C:\Windows\regsvr32.exe	85f2c3eef0238b6d115b4b83e0fec9a060673e05aeeaacea4ad98a7fec07cee6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1716	regsvr32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1728	DllHost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1716	1976	85f2c3eef0238b6d115b4b83e0fec9a060673e05aeeaacea4ad98a7fec07cee6.exe	28
PID 1976 wrote to memory of 1716	1976	85f2c3eef0238b6d115b4b83e0fec9a060673e05aeeaacea4ad98a7fec07cee6.exe	28
PID 1976 wrote to memory of 1716	1976	85f2c3eef0238b6d115b4b83e0fec9a060673e05aeeaacea4ad98a7fec07cee6.exe	28
PID 1976 wrote to memory of 1716	1976	85f2c3eef0238b6d115b4b83e0fec9a060673e05aeeaacea4ad98a7fec07cee6.exe	28

C:\Users\Admin\AppData\Local\Temp\85f2c3eef0238b6d115b4b83e0fec9a060673e05aeeaacea4ad98a7fec07cee6.exe
"C:\Users\Admin\AppData\Local\Temp\85f2c3eef0238b6d115b4b83e0fec9a060673e05aeeaacea4ad98a7fec07cee6.exe"
1⤵
- Disables RegEdit via registry modification
- Modifies Installed Components in the registry
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\regsvr32.exe
  C:\Windows\regsvr32.exe
  2⤵
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Modifies Installed Components in the registry
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1716

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1728

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\saima.jpg

Filesize
808KB

MD5
2221a2d3327fd797ac71919792138698

SHA1
b33c0f1f4a99febe1a099ed527789355f3b3dd97

SHA256
6c4c95521c26c631a1127c34113d46db8d880a207bab70a3ed64e92c090091b1

SHA512
10bba1da0dc61e347de0b37fc260895e76fedf72d7fe19afa5283eabb97a53f71fe63bd3f1e20d8dc9579822375a0cfed4c1b3efe68e570e4e4117e5c8336461

Download Submit
C:\Windows\SysWOW64\OLE32Init.exe

Filesize
853KB

MD5
421b576d79d523dded2e4b93e1825719

SHA1
9543ae800b6c001ca3613c1cf526fdb11e9ebe67

SHA256
cf10888ab4240bda52b81435dc9f19dfa5d6c217b48299297cef265064e89c06

SHA512
d7d6d3eaf39adc981f9e31a8f185edda40cb001301dc033e3e8c2340161d4f1cbf36503748f474c203c5c43d7a1c8b186b15b28f64e09bb8fa751e9f0fbdb5ae

Download Submit
C:\Windows\regsvr32.exe

Filesize
853KB

MD5
421b576d79d523dded2e4b93e1825719

SHA1
9543ae800b6c001ca3613c1cf526fdb11e9ebe67

SHA256
cf10888ab4240bda52b81435dc9f19dfa5d6c217b48299297cef265064e89c06

SHA512
d7d6d3eaf39adc981f9e31a8f185edda40cb001301dc033e3e8c2340161d4f1cbf36503748f474c203c5c43d7a1c8b186b15b28f64e09bb8fa751e9f0fbdb5ae

Download Submit
C:\Windows\regsvr32.exe

Filesize
853KB

MD5
421b576d79d523dded2e4b93e1825719

SHA1
9543ae800b6c001ca3613c1cf526fdb11e9ebe67

SHA256
cf10888ab4240bda52b81435dc9f19dfa5d6c217b48299297cef265064e89c06

SHA512
d7d6d3eaf39adc981f9e31a8f185edda40cb001301dc033e3e8c2340161d4f1cbf36503748f474c203c5c43d7a1c8b186b15b28f64e09bb8fa751e9f0fbdb5ae

Download Submit
memory/1716-60-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1716-65-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1976-54-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1976-55-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1976-59-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing