e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052

General

Target

e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe
Size

478KB
MD5

b8ea7cfc4cad7f1aa0241ace0fb42f8e
SHA1

dd66fd0232e496cc5eec33c503b73d2574068291
SHA256

e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052
SHA512

24ddd1baca24174474d72d73b91d82dd918012cfe74a9c04edbcc640cf78d6082f33998664a2ac00c33e03886c0581f0e71b317d4b9c6e716f5b2844bc7f9b93
SSDEEP

12288:m9v5f/0M1eMMKtBpuQyqxXUUBMMnMMMMMzBDPWAzgYkBgfo8o/uPJ:m9v5f/0M1eM5hBMMnMMMMMzxWAzzGhWP

Score

8^/10

evasion persistence

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Executes dropped EXE 1 IoCs

pid	Process
3124	UmVbuJTOLvHcFx.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UmVbuJTOLvHcFx.exe = "C:\\ProgramData\\UmVbuJTOLvHcFx.exe"	e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Download	e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
5068	e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe
5068	e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe
5068	e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe
5068	e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe
3124	UmVbuJTOLvHcFx.exe
3124	UmVbuJTOLvHcFx.exe
3124	UmVbuJTOLvHcFx.exe
3124	UmVbuJTOLvHcFx.exe
3124	UmVbuJTOLvHcFx.exe
3124	UmVbuJTOLvHcFx.exe
3124	UmVbuJTOLvHcFx.exe
3124	UmVbuJTOLvHcFx.exe
3124	UmVbuJTOLvHcFx.exe
3124	UmVbuJTOLvHcFx.exe
3124	UmVbuJTOLvHcFx.exe
3124	UmVbuJTOLvHcFx.exe
3124	UmVbuJTOLvHcFx.exe
3124	UmVbuJTOLvHcFx.exe
3124	UmVbuJTOLvHcFx.exe
3124	UmVbuJTOLvHcFx.exe
3124	UmVbuJTOLvHcFx.exe
3124	UmVbuJTOLvHcFx.exe
3124	UmVbuJTOLvHcFx.exe
3124	UmVbuJTOLvHcFx.exe
3124	UmVbuJTOLvHcFx.exe
3124	UmVbuJTOLvHcFx.exe
3124	UmVbuJTOLvHcFx.exe
3124	UmVbuJTOLvHcFx.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5068	e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 3124	5068	e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe	81
PID 5068 wrote to memory of 3124	5068	e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe	81
PID 5068 wrote to memory of 3124	5068	e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe	81
PID 3124 wrote to memory of 3092	3124	UmVbuJTOLvHcFx.exe	27
PID 3124 wrote to memory of 3092	3124	UmVbuJTOLvHcFx.exe	27
PID 3124 wrote to memory of 3092	3124	UmVbuJTOLvHcFx.exe	27
PID 3124 wrote to memory of 3092	3124	UmVbuJTOLvHcFx.exe	27
PID 3124 wrote to memory of 3092	3124	UmVbuJTOLvHcFx.exe	27
PID 3124 wrote to memory of 3092	3124	UmVbuJTOLvHcFx.exe	27
PID 3124 wrote to memory of 3092	3124	UmVbuJTOLvHcFx.exe	27
PID 3124 wrote to memory of 3092	3124	UmVbuJTOLvHcFx.exe	27
PID 3124 wrote to memory of 3092	3124	UmVbuJTOLvHcFx.exe	27
PID 3124 wrote to memory of 3092	3124	UmVbuJTOLvHcFx.exe	27

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3092
- C:\Users\Admin\AppData\Local\Temp\e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe
  "C:\Users\Admin\AppData\Local\Temp\e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5068
- - C:\ProgramData\UmVbuJTOLvHcFx.exe
    "C:\ProgramData\UmVbuJTOLvHcFx.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\UmVbuJTOLvHcFx.exe

Filesize
478KB

MD5
b8ea7cfc4cad7f1aa0241ace0fb42f8e

SHA1
dd66fd0232e496cc5eec33c503b73d2574068291

SHA256
e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052

SHA512
24ddd1baca24174474d72d73b91d82dd918012cfe74a9c04edbcc640cf78d6082f33998664a2ac00c33e03886c0581f0e71b317d4b9c6e716f5b2844bc7f9b93

Download Submit
C:\ProgramData\UmVbuJTOLvHcFx.exe

Filesize
478KB

MD5
b8ea7cfc4cad7f1aa0241ace0fb42f8e

SHA1
dd66fd0232e496cc5eec33c503b73d2574068291

SHA256
e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052

SHA512
24ddd1baca24174474d72d73b91d82dd918012cfe74a9c04edbcc640cf78d6082f33998664a2ac00c33e03886c0581f0e71b317d4b9c6e716f5b2844bc7f9b93

Download Submit
memory/5068-132-0x0000000000900000-0x0000000000971000-memory.dmp

Filesize
452KB

Download
memory/5068-133-0x0000000014000000-0x000000001414E000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads