c33c1ff223a1559d988803a84fe0973c56362782ff36134398c8ffafb5efcd56

General

Target

c33c1ff223a1559d988803a84fe0973c56362782ff36134398c8ffafb5efcd56.exe
Size

89KB
MD5

e982f8207670946d5bcc18581caf6e89
SHA1

003881e35f529faaa485e42d78ebd889674412cb
SHA256

c33c1ff223a1559d988803a84fe0973c56362782ff36134398c8ffafb5efcd56
SHA512

d9814a9176c27e48d42258b1e615ddc94c68dbc6fc901c19e2d992b6333f2c803eda8ef8506ab997115af0b507ee5aae1ef5c52f261e02ff4df072e0b8700e3d
SSDEEP

1536:ARFtqMnrgUfv0L6p326kF3CBg72dxNGgSuoCswHW:AflpECBk23UgSuEw2

Score

8^/10

evasion persistence

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	c33c1ff223a1559d988803a84fe0973c56362782ff36134398c8ffafb5efcd56.exe

Disables Task Manager via registry modification
evasion

Executes dropped EXE 1 IoCs

pid	Process
4768	ADBCDEE5E570678.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explorer.lnk	c33c1ff223a1559d988803a84fe0973c56362782ff36134398c8ffafb5efcd56.exe

Loads dropped DLL 1 IoCs

pid	Process
4768	ADBCDEE5E570678.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	c33c1ff223a1559d988803a84fe0973c56362782ff36134398c8ffafb5efcd56.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ADBCDEE5E570678 = "C:\\ProgramData\\ADBCDEE5E570678\\ADBCDEE5E570678.exe"	c33c1ff223a1559d988803a84fe0973c56362782ff36134398c8ffafb5efcd56.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	c33c1ff223a1559d988803a84fe0973c56362782ff36134398c8ffafb5efcd56.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ADBCDEE5E570678 = "C:\\ProgramData\\ADBCDEE5E570678\\ADBCDEE5E570678.exe"	c33c1ff223a1559d988803a84fe0973c56362782ff36134398c8ffafb5efcd56.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
3852	ipconfig.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4768	ADBCDEE5E570678.exe
4768	ADBCDEE5E570678.exe
4768	ADBCDEE5E570678.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 488 wrote to memory of 4768	488	c33c1ff223a1559d988803a84fe0973c56362782ff36134398c8ffafb5efcd56.exe	78
PID 488 wrote to memory of 4768	488	c33c1ff223a1559d988803a84fe0973c56362782ff36134398c8ffafb5efcd56.exe	78
PID 488 wrote to memory of 4768	488	c33c1ff223a1559d988803a84fe0973c56362782ff36134398c8ffafb5efcd56.exe	78
PID 4768 wrote to memory of 3852	4768	ADBCDEE5E570678.exe	79
PID 4768 wrote to memory of 3852	4768	ADBCDEE5E570678.exe	79
PID 4768 wrote to memory of 3852	4768	ADBCDEE5E570678.exe	79

C:\Users\Admin\AppData\Local\Temp\c33c1ff223a1559d988803a84fe0973c56362782ff36134398c8ffafb5efcd56.exe
"C:\Users\Admin\AppData\Local\Temp\c33c1ff223a1559d988803a84fe0973c56362782ff36134398c8ffafb5efcd56.exe"
1⤵
- Disables RegEdit via registry modification
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:488
- C:\ProgramData\ADBCDEE5E570678\ADBCDEE5E570678.exe
  C:\ProgramData\ADBCDEE5E570678\ADBCDEE5E570678.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdns && ipconfig /renew
    3⤵
    - Gathers network information
    PID:3852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ADBCDEE5E570678\ADBCDEE5E570678.exe

Filesize
89KB

MD5
e982f8207670946d5bcc18581caf6e89

SHA1
003881e35f529faaa485e42d78ebd889674412cb

SHA256
c33c1ff223a1559d988803a84fe0973c56362782ff36134398c8ffafb5efcd56

SHA512
d9814a9176c27e48d42258b1e615ddc94c68dbc6fc901c19e2d992b6333f2c803eda8ef8506ab997115af0b507ee5aae1ef5c52f261e02ff4df072e0b8700e3d

Download Submit
C:\ProgramData\ADBCDEE5E570678\ADBCDEE5E570678.exe

Filesize
89KB

MD5
e982f8207670946d5bcc18581caf6e89

SHA1
003881e35f529faaa485e42d78ebd889674412cb

SHA256
c33c1ff223a1559d988803a84fe0973c56362782ff36134398c8ffafb5efcd56

SHA512
d9814a9176c27e48d42258b1e615ddc94c68dbc6fc901c19e2d992b6333f2c803eda8ef8506ab997115af0b507ee5aae1ef5c52f261e02ff4df072e0b8700e3d

Download Submit
C:\Users\Admin\AppData\Roaming\twain.dll

Filesize
3KB

MD5
e9032dac10fb27acfa89c3357fad86b3

SHA1
1623843e0d369c9911989c0730a6470c22dd60fd

SHA256
9de0bb4cb8a79f575da4dbc86cedb6a9ef8d94c0b176fd4690b9b7ffee078391

SHA512
70e663ad1e87832673f7140aca20dcd3db46c256b91f2924e7a9e1ab24a295d432b625fdcc53b1f3bbc84f91390190e4bd483da5285f95ed0316be09b2b82004

Download Submit
memory/488-132-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/488-136-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4768-137-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4768-140-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing