ab9119d97b68ed438349e88416d08ad335b5729de5dbd3c200a70fc176f22c73

General

Target

ab9119d97b68ed438349e88416d08ad335b5729de5dbd3c200a70fc176f22c73.exe
Size

68KB
MD5

6c98703960644f5c7748f960f34bde60
SHA1

11d18c4aae04940527c72e513ddf93f81ae6860b
SHA256

ab9119d97b68ed438349e88416d08ad335b5729de5dbd3c200a70fc176f22c73
SHA512

301db7f2bab3132c76e8816e2c2caeb29a9f77a945ddeb25d5a903e757329eb51cb515f083ea313fbecc3f8c1225178c43506c9a6675aa24419187f72ad6cd01
SSDEEP

768:6vtqK0iVsLL53OgYCJO9FwKtJoTQrQD7/BCES89sFs6MyS1:6k5kgYCYjtC+89sFslr1

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	dualaa.exe

Executes dropped EXE 1 IoCs

pid	Process
2040	dualaa.exe

Loads dropped DLL 2 IoCs

pid	Process
1724	ab9119d97b68ed438349e88416d08ad335b5729de5dbd3c200a70fc176f22c73.exe
1724	ab9119d97b68ed438349e88416d08ad335b5729de5dbd3c200a70fc176f22c73.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\	dualaa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dualaa = "C:\\Users\\Admin\\dualaa.exe"	dualaa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2040	dualaa.exe
2040	dualaa.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1724	ab9119d97b68ed438349e88416d08ad335b5729de5dbd3c200a70fc176f22c73.exe
2040	dualaa.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2040	1724	ab9119d97b68ed438349e88416d08ad335b5729de5dbd3c200a70fc176f22c73.exe	27
PID 1724 wrote to memory of 2040	1724	ab9119d97b68ed438349e88416d08ad335b5729de5dbd3c200a70fc176f22c73.exe	27
PID 1724 wrote to memory of 2040	1724	ab9119d97b68ed438349e88416d08ad335b5729de5dbd3c200a70fc176f22c73.exe	27
PID 1724 wrote to memory of 2040	1724	ab9119d97b68ed438349e88416d08ad335b5729de5dbd3c200a70fc176f22c73.exe	27
PID 2040 wrote to memory of 1724	2040	dualaa.exe	26
PID 2040 wrote to memory of 1724	2040	dualaa.exe	26
PID 2040 wrote to memory of 1724	2040	dualaa.exe	26
PID 2040 wrote to memory of 1724	2040	dualaa.exe	26

C:\Users\Admin\AppData\Local\Temp\ab9119d97b68ed438349e88416d08ad335b5729de5dbd3c200a70fc176f22c73.exe
"C:\Users\Admin\AppData\Local\Temp\ab9119d97b68ed438349e88416d08ad335b5729de5dbd3c200a70fc176f22c73.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\dualaa.exe
  "C:\Users\Admin\dualaa.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\dualaa.exe

Filesize
68KB

MD5
57fdad2a3189bda2c799b3cade0df4d5

SHA1
b2c154127735fbc4e15d9459ecd74692d1e1a12b

SHA256
3136f7f27b87b5c5124997ba7091905d8f4913a5c93462a1cbf35ebbbfaa51a3

SHA512
fda656f535ba4dde6c3a7def04edafb120730d87f9bbb877d04ffde27d50ad1d4cbfddfdb7887e62e1e3a836facce2dbaa71761a500f196736d569c5ad10b225

Download Submit
C:\Users\Admin\dualaa.exe

Filesize
68KB

MD5
57fdad2a3189bda2c799b3cade0df4d5

SHA1
b2c154127735fbc4e15d9459ecd74692d1e1a12b

SHA256
3136f7f27b87b5c5124997ba7091905d8f4913a5c93462a1cbf35ebbbfaa51a3

SHA512
fda656f535ba4dde6c3a7def04edafb120730d87f9bbb877d04ffde27d50ad1d4cbfddfdb7887e62e1e3a836facce2dbaa71761a500f196736d569c5ad10b225

Download Submit
\Users\Admin\dualaa.exe

Filesize
68KB

MD5
57fdad2a3189bda2c799b3cade0df4d5

SHA1
b2c154127735fbc4e15d9459ecd74692d1e1a12b

SHA256
3136f7f27b87b5c5124997ba7091905d8f4913a5c93462a1cbf35ebbbfaa51a3

SHA512
fda656f535ba4dde6c3a7def04edafb120730d87f9bbb877d04ffde27d50ad1d4cbfddfdb7887e62e1e3a836facce2dbaa71761a500f196736d569c5ad10b225

Download Submit
\Users\Admin\dualaa.exe

Filesize
68KB

MD5
57fdad2a3189bda2c799b3cade0df4d5

SHA1
b2c154127735fbc4e15d9459ecd74692d1e1a12b

SHA256
3136f7f27b87b5c5124997ba7091905d8f4913a5c93462a1cbf35ebbbfaa51a3

SHA512
fda656f535ba4dde6c3a7def04edafb120730d87f9bbb877d04ffde27d50ad1d4cbfddfdb7887e62e1e3a836facce2dbaa71761a500f196736d569c5ad10b225

Download Submit
memory/1724-56-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads