bcb5e52dbf9925999cbca08d61400602025789d319e15c2427f8809ac35d51a0

General

Target

bcb5e52dbf9925999cbca08d61400602025789d319e15c2427f8809ac35d51a0.exe
Size

95KB
MD5

212a991b8053674b0b6c054534558676
SHA1

461ecc63db705949f900c5078cb122860771111e
SHA256

bcb5e52dbf9925999cbca08d61400602025789d319e15c2427f8809ac35d51a0
SHA512

bd0c386cb9e9ad61eac7df206d9f3b5108bbd9d1e73a5e9a55f4e9580be2f5c3408779774309168ac26981fe409fecaccf299ea0b41bf9de292a68efffb11e77
SSDEEP

1536:CKDqJvz2xyM40DSmJEKEFXvx52/DVTW1qfc:CKDAfCDSmJEXc/Ri1q

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\bcb5e52dbf9925999cbca08d61400602025789d319e15c2427f8809ac35d51a0.exe	bcb5e52dbf9925999cbca08d61400602025789d319e15c2427f8809ac35d51a0.exe
File created	C:\Windows\SysWOW64\drivers\bcb5e52dbf9925999cbca08d61400602025789d319e15c2427f8809ac35d51a0.exe	bcb5e52dbf9925999cbca08d61400602025789d319e15c2427f8809ac35d51a0.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	bcb5e52dbf9925999cbca08d61400602025789d319e15c2427f8809ac35d51a0.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bcb5e52dbf9925999cbca08d61400602025789d319e15c2427f8809ac35d51a0.lnk	bcb5e52dbf9925999cbca08d61400602025789d319e15c2427f8809ac35d51a0.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bcb5e52dbf9925999cbca08d61400602025789d319e15c2427f8809ac35d51a0.lnk	bcb5e52dbf9925999cbca08d61400602025789d319e15c2427f8809ac35d51a0.exe

Loads dropped DLL 6 IoCs

pid	Process
996	bcb5e52dbf9925999cbca08d61400602025789d319e15c2427f8809ac35d51a0.exe
996	bcb5e52dbf9925999cbca08d61400602025789d319e15c2427f8809ac35d51a0.exe
996	bcb5e52dbf9925999cbca08d61400602025789d319e15c2427f8809ac35d51a0.exe
996	bcb5e52dbf9925999cbca08d61400602025789d319e15c2427f8809ac35d51a0.exe
996	bcb5e52dbf9925999cbca08d61400602025789d319e15c2427f8809ac35d51a0.exe
996	bcb5e52dbf9925999cbca08d61400602025789d319e15c2427f8809ac35d51a0.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	bcb5e52dbf9925999cbca08d61400602025789d319e15c2427f8809ac35d51a0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\System32\\drivers\\bcb5e52dbf9925999cbca08d61400602025789d319e15c2427f8809ac35d51a0"	bcb5e52dbf9925999cbca08d61400602025789d319e15c2427f8809ac35d51a0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 15 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{80EBF771-75FF-11ED-B5DD-DEE008EA10AF}.dat = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{80EBF76F-75FF-11ED-B5DD-DEE008EA10AF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Recovery\PendingDelete	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	bcb5e52dbf9925999cbca08d61400602025789d319e15c2427f8809ac35d51a0.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1460	iexplore.exe
1460	iexplore.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 1460	996	bcb5e52dbf9925999cbca08d61400602025789d319e15c2427f8809ac35d51a0.exe	84
PID 996 wrote to memory of 1460	996	bcb5e52dbf9925999cbca08d61400602025789d319e15c2427f8809ac35d51a0.exe	84
PID 1460 wrote to memory of 3144	1460	iexplore.exe	85
PID 1460 wrote to memory of 3144	1460	iexplore.exe	85
PID 1460 wrote to memory of 3144	1460	iexplore.exe	85

C:\Users\Admin\AppData\Local\Temp\bcb5e52dbf9925999cbca08d61400602025789d319e15c2427f8809ac35d51a0.exe
"C:\Users\Admin\AppData\Local\Temp\bcb5e52dbf9925999cbca08d61400602025789d319e15c2427f8809ac35d51a0.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:996
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\Raila Odinga.gif
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1460 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    PID:3144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nswB6CF.tmp\System.dll

Filesize
10KB

MD5
ed228603bf5d6ba382b59274dba35a0a

SHA1
037d40e0399902b5119d48995dfd2e96bc6de9a4

SHA256
a1bada98dffbe23a96af2ce3f4df7d7927cec6ea0a1d2d1f77862fb117a74f37

SHA512
9dabf495eaeb979235b7626c0619bb8eaab61c158e66799b1afdb1500952c789b7ea645a358c8961876e06a9ec168159ef405b6238ec692f1f89fc1ccb1e9ae9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswB6CF.tmp\System.dll

Filesize
10KB

MD5
ed228603bf5d6ba382b59274dba35a0a

SHA1
037d40e0399902b5119d48995dfd2e96bc6de9a4

SHA256
a1bada98dffbe23a96af2ce3f4df7d7927cec6ea0a1d2d1f77862fb117a74f37

SHA512
9dabf495eaeb979235b7626c0619bb8eaab61c158e66799b1afdb1500952c789b7ea645a358c8961876e06a9ec168159ef405b6238ec692f1f89fc1ccb1e9ae9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswB6CF.tmp\System.dll

Filesize
10KB

MD5
ed228603bf5d6ba382b59274dba35a0a

SHA1
037d40e0399902b5119d48995dfd2e96bc6de9a4

SHA256
a1bada98dffbe23a96af2ce3f4df7d7927cec6ea0a1d2d1f77862fb117a74f37

SHA512
9dabf495eaeb979235b7626c0619bb8eaab61c158e66799b1afdb1500952c789b7ea645a358c8961876e06a9ec168159ef405b6238ec692f1f89fc1ccb1e9ae9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswB6CF.tmp\System.dll

Filesize
10KB

MD5
ed228603bf5d6ba382b59274dba35a0a

SHA1
037d40e0399902b5119d48995dfd2e96bc6de9a4

SHA256
a1bada98dffbe23a96af2ce3f4df7d7927cec6ea0a1d2d1f77862fb117a74f37

SHA512
9dabf495eaeb979235b7626c0619bb8eaab61c158e66799b1afdb1500952c789b7ea645a358c8961876e06a9ec168159ef405b6238ec692f1f89fc1ccb1e9ae9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswB6CF.tmp\System.dll

Filesize
10KB

MD5
ed228603bf5d6ba382b59274dba35a0a

SHA1
037d40e0399902b5119d48995dfd2e96bc6de9a4

SHA256
a1bada98dffbe23a96af2ce3f4df7d7927cec6ea0a1d2d1f77862fb117a74f37

SHA512
9dabf495eaeb979235b7626c0619bb8eaab61c158e66799b1afdb1500952c789b7ea645a358c8961876e06a9ec168159ef405b6238ec692f1f89fc1ccb1e9ae9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswB6CF.tmp\System.dll

Filesize
10KB

MD5
ed228603bf5d6ba382b59274dba35a0a

SHA1
037d40e0399902b5119d48995dfd2e96bc6de9a4

SHA256
a1bada98dffbe23a96af2ce3f4df7d7927cec6ea0a1d2d1f77862fb117a74f37

SHA512
9dabf495eaeb979235b7626c0619bb8eaab61c158e66799b1afdb1500952c789b7ea645a358c8961876e06a9ec168159ef405b6238ec692f1f89fc1ccb1e9ae9

Download Submit
memory/996-132-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/996-135-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads