70c3e78ec30c8506ce07016b331b52af8ceb324a215879511b029ccd3b890dc9

General

Target

70c3e78ec30c8506ce07016b331b52af8ceb324a215879511b029ccd3b890dc9.exe
Size

396KB
MD5

204e088fcbdc093462f905c72503ac90
SHA1

fd0f3ff6dbe36c37aba88048f9e5c154c9dfb1db
SHA256

70c3e78ec30c8506ce07016b331b52af8ceb324a215879511b029ccd3b890dc9
SHA512

c17dfd16d27902515f95a51681dc9a311e3bee65ea91ecdb17b4e364f86a1cc872c6a6bff29f7ab103dd262e215ff153ac42ced30fdb8e158624c5d9d637b661
SSDEEP

12288:K83w3qF9uAvWR4126npWzdhlG8dj+6ciDeCm/yNyh56VOSsHYuCiDrPA6n/anhVa:K83w3qF9uAvWR4126npWzdhlG8dj+Hhh

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 19 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	70c3e78ec30c8506ce07016b331b52af8ceb324a215879511b029ccd3b890dc9.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_Classes\Local Settings	70c3e78ec30c8506ce07016b331b52af8ceb324a215879511b029ccd3b890dc9.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	70c3e78ec30c8506ce07016b331b52af8ceb324a215879511b029ccd3b890dc9.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	70c3e78ec30c8506ce07016b331b52af8ceb324a215879511b029ccd3b890dc9.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	70c3e78ec30c8506ce07016b331b52af8ceb324a215879511b029ccd3b890dc9.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	70c3e78ec30c8506ce07016b331b52af8ceb324a215879511b029ccd3b890dc9.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	70c3e78ec30c8506ce07016b331b52af8ceb324a215879511b029ccd3b890dc9.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	70c3e78ec30c8506ce07016b331b52af8ceb324a215879511b029ccd3b890dc9.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	70c3e78ec30c8506ce07016b331b52af8ceb324a215879511b029ccd3b890dc9.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	70c3e78ec30c8506ce07016b331b52af8ceb324a215879511b029ccd3b890dc9.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	70c3e78ec30c8506ce07016b331b52af8ceb324a215879511b029ccd3b890dc9.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	70c3e78ec30c8506ce07016b331b52af8ceb324a215879511b029ccd3b890dc9.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	70c3e78ec30c8506ce07016b331b52af8ceb324a215879511b029ccd3b890dc9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	70c3e78ec30c8506ce07016b331b52af8ceb324a215879511b029ccd3b890dc9.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	70c3e78ec30c8506ce07016b331b52af8ceb324a215879511b029ccd3b890dc9.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	70c3e78ec30c8506ce07016b331b52af8ceb324a215879511b029ccd3b890dc9.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	70c3e78ec30c8506ce07016b331b52af8ceb324a215879511b029ccd3b890dc9.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	70c3e78ec30c8506ce07016b331b52af8ceb324a215879511b029ccd3b890dc9.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	70c3e78ec30c8506ce07016b331b52af8ceb324a215879511b029ccd3b890dc9.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
892	70c3e78ec30c8506ce07016b331b52af8ceb324a215879511b029ccd3b890dc9.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
892	70c3e78ec30c8506ce07016b331b52af8ceb324a215879511b029ccd3b890dc9.exe
892	70c3e78ec30c8506ce07016b331b52af8ceb324a215879511b029ccd3b890dc9.exe
892	70c3e78ec30c8506ce07016b331b52af8ceb324a215879511b029ccd3b890dc9.exe

C:\Users\Admin\AppData\Local\Temp\70c3e78ec30c8506ce07016b331b52af8ceb324a215879511b029ccd3b890dc9.exe
"C:\Users\Admin\AppData\Local\Temp\70c3e78ec30c8506ce07016b331b52af8ceb324a215879511b029ccd3b890dc9.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/892-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/892-55-0x0000000074D91000-0x0000000074D93000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing