7604442ccb91fc744c44373dac931177fb00f94520de39a5fc19be1f2951448c

General

Target

7604442ccb91fc744c44373dac931177fb00f94520de39a5fc19be1f2951448c.exe
Size

83KB
MD5

6515d4c784e833dc7410c31aabfc75b9
SHA1

562c8506e64a16a30d4e8cfa923e3e009c7509c9
SHA256

7604442ccb91fc744c44373dac931177fb00f94520de39a5fc19be1f2951448c
SHA512

234ce04992b111dcf7d05700c6ff638c09a7590581bc0cb6cad6896a7ef6de20d898b2e94a39ab7c25a3bd934ec2d127f5d9f95a7aed58990a7c0d51bd1c3bcf
SSDEEP

1536:qJ0CFdOpROE4qb9cIbzB8qhPgZ64/vR07ZwIOiNu9Lxb7UB7lbZ+CoQ68/:q2pGkrt8qhPFivC7iI/NyVnMB9+Coo/

Score

8^/10

upx

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\filem.sys	LoadDriver.exe
File opened for modification	C:\Windows\SysWOW64\drivers\filem.sys	LoadDriver.exe

Executes dropped EXE 1 IoCs

pid	Process
2628	LoadDriver.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1892-132-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/1892-136-0x0000000000400000-0x0000000000425000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	7604442ccb91fc744c44373dac931177fb00f94520de39a5fc19be1f2951448c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	LoadDriver.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Internet Explorer\config.ini	7604442ccb91fc744c44373dac931177fb00f94520de39a5fc19be1f2951448c.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\filem.sys	7604442ccb91fc744c44373dac931177fb00f94520de39a5fc19be1f2951448c.exe
File created	C:\Program Files (x86)\Internet Explorer\LoadDriver.exe	7604442ccb91fc744c44373dac931177fb00f94520de39a5fc19be1f2951448c.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\LoadDriver.exe	7604442ccb91fc744c44373dac931177fb00f94520de39a5fc19be1f2951448c.exe
File opened for modification	C:\Program Files\Internet Explorer\SIGNUP\ietranst.dll	LoadDriver.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\config.ini	7604442ccb91fc744c44373dac931177fb00f94520de39a5fc19be1f2951448c.exe
File created	C:\Program Files (x86)\Internet Explorer\filem.sys	7604442ccb91fc744c44373dac931177fb00f94520de39a5fc19be1f2951448c.exe
File created	C:\Program Files (x86)\Internet Explorer\IEXPLORER.exe	7604442ccb91fc744c44373dac931177fb00f94520de39a5fc19be1f2951448c.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\IEXPLORER.exe	7604442ccb91fc744c44373dac931177fb00f94520de39a5fc19be1f2951448c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 2628	1892	7604442ccb91fc744c44373dac931177fb00f94520de39a5fc19be1f2951448c.exe	84
PID 1892 wrote to memory of 2628	1892	7604442ccb91fc744c44373dac931177fb00f94520de39a5fc19be1f2951448c.exe	84
PID 1892 wrote to memory of 2628	1892	7604442ccb91fc744c44373dac931177fb00f94520de39a5fc19be1f2951448c.exe	84

C:\Users\Admin\AppData\Local\Temp\7604442ccb91fc744c44373dac931177fb00f94520de39a5fc19be1f2951448c.exe
"C:\Users\Admin\AppData\Local\Temp\7604442ccb91fc744c44373dac931177fb00f94520de39a5fc19be1f2951448c.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Program Files (x86)\Internet Explorer\LoadDriver.exe
  "C:\Program Files (x86)\Internet Explorer\LoadDriver.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Checks computer location settings
  - Drops file in Program Files directory
  PID:2628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Internet Explorer\LoadDriver.exe

Filesize
100KB

MD5
2b0e769109474fbb55070ea0f33e2ea6

SHA1
ca82d9d405193a5a204ed89cddb735ba5f3818ba

SHA256
fffbc9ece4a5a175b515501f6274df314b0221437544892317cf791883070dcf

SHA512
d859fcd4a88011f383d7f25b9907b4dde617ff09dab2b740d642aef0374433c8aff5f745d65bbe1cde723875c6eea979ab852f9b67e24b590c38d6edc52dab88

Download Submit
C:\Program Files (x86)\Internet Explorer\LoadDriver.exe

Filesize
100KB

MD5
2b0e769109474fbb55070ea0f33e2ea6

SHA1
ca82d9d405193a5a204ed89cddb735ba5f3818ba

SHA256
fffbc9ece4a5a175b515501f6274df314b0221437544892317cf791883070dcf

SHA512
d859fcd4a88011f383d7f25b9907b4dde617ff09dab2b740d642aef0374433c8aff5f745d65bbe1cde723875c6eea979ab852f9b67e24b590c38d6edc52dab88

Download Submit
C:\Program Files (x86)\Internet Explorer\config.ini

Filesize
3B

MD5
e5f6ad6ce374177eef023bf5d0c018b6

SHA1
f33f7ae89c2c6ab8e29a3cb0a97bb1f9456aacba

SHA256
5b4afb8d2ed60a5777760a1cd17fb91b7c940c125cc7f74ae40b75df92036e5b

SHA512
51e882750fc417121dadc0b7a62211048de290eccee28109a9eea6b9cc34d6f8465af83d2de209d632940e4ca892c728b1e195928b6bbc67f2a8bb9233c9766c

Download Submit
memory/1892-132-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1892-136-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing