7ef4fc1d192596b419ba320338f34c129eba80fe81ef4bb0c94fc6beba30178b

General

Target

7ef4fc1d192596b419ba320338f34c129eba80fe81ef4bb0c94fc6beba30178b.exe
Size

241KB
MD5

20cf4b44daab3b25c07271bafc38a260
SHA1

4fcca608189031fa654f3c34b5e54a51b37b5b07
SHA256

7ef4fc1d192596b419ba320338f34c129eba80fe81ef4bb0c94fc6beba30178b
SHA512

0234c1ca350a53cbb1565a3d8ae26c50fe40bd420f0bf4df33e334d1db95f639ed2323edd63f8a043be2da3c0afcd61b913249891fa77545eee333f009a400b3
SSDEEP

3072:uyAB22qDo7qkXT5J9dWZ8j2/drWfd0PXhphbLeSzBHdHI2hB6JXy4:8BphqkD5X4Z8IoyPjMS7HTy

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\43843 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\ccjdhqwd.pif"	svchost.exe

Executes dropped EXE 2 IoCs

pid	Process
3824	fflnvackuxddlryaagiuuxdjltaemoou.com
228	fflnvackuxddlryaagiuuxdjltaemoou.com

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	7ef4fc1d192596b419ba320338f34c129eba80fe81ef4bb0c94fc6beba30178b.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1028 set thread context of 1900	1028	7ef4fc1d192596b419ba320338f34c129eba80fe81ef4bb0c94fc6beba30178b.exe	81
PID 3824 set thread context of 228	3824	fflnvackuxddlryaagiuuxdjltaemoou.com	86

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~3\LOCALS~1\Temp\ccjdhqwd.pif	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
228	fflnvackuxddlryaagiuuxdjltaemoou.com
228	fflnvackuxddlryaagiuuxdjltaemoou.com

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 1900	1028	7ef4fc1d192596b419ba320338f34c129eba80fe81ef4bb0c94fc6beba30178b.exe	81
PID 1028 wrote to memory of 1900	1028	7ef4fc1d192596b419ba320338f34c129eba80fe81ef4bb0c94fc6beba30178b.exe	81
PID 1028 wrote to memory of 1900	1028	7ef4fc1d192596b419ba320338f34c129eba80fe81ef4bb0c94fc6beba30178b.exe	81
PID 1028 wrote to memory of 1900	1028	7ef4fc1d192596b419ba320338f34c129eba80fe81ef4bb0c94fc6beba30178b.exe	81
PID 1028 wrote to memory of 1900	1028	7ef4fc1d192596b419ba320338f34c129eba80fe81ef4bb0c94fc6beba30178b.exe	81
PID 1028 wrote to memory of 1900	1028	7ef4fc1d192596b419ba320338f34c129eba80fe81ef4bb0c94fc6beba30178b.exe	81
PID 1028 wrote to memory of 1900	1028	7ef4fc1d192596b419ba320338f34c129eba80fe81ef4bb0c94fc6beba30178b.exe	81
PID 1028 wrote to memory of 1900	1028	7ef4fc1d192596b419ba320338f34c129eba80fe81ef4bb0c94fc6beba30178b.exe	81
PID 1900 wrote to memory of 3824	1900	7ef4fc1d192596b419ba320338f34c129eba80fe81ef4bb0c94fc6beba30178b.exe	84
PID 1900 wrote to memory of 3824	1900	7ef4fc1d192596b419ba320338f34c129eba80fe81ef4bb0c94fc6beba30178b.exe	84
PID 1900 wrote to memory of 3824	1900	7ef4fc1d192596b419ba320338f34c129eba80fe81ef4bb0c94fc6beba30178b.exe	84
PID 3824 wrote to memory of 228	3824	fflnvackuxddlryaagiuuxdjltaemoou.com	86
PID 3824 wrote to memory of 228	3824	fflnvackuxddlryaagiuuxdjltaemoou.com	86
PID 3824 wrote to memory of 228	3824	fflnvackuxddlryaagiuuxdjltaemoou.com	86
PID 3824 wrote to memory of 228	3824	fflnvackuxddlryaagiuuxdjltaemoou.com	86
PID 3824 wrote to memory of 228	3824	fflnvackuxddlryaagiuuxdjltaemoou.com	86
PID 3824 wrote to memory of 228	3824	fflnvackuxddlryaagiuuxdjltaemoou.com	86
PID 228 wrote to memory of 856	228	fflnvackuxddlryaagiuuxdjltaemoou.com	87
PID 228 wrote to memory of 856	228	fflnvackuxddlryaagiuuxdjltaemoou.com	87
PID 228 wrote to memory of 856	228	fflnvackuxddlryaagiuuxdjltaemoou.com	87

C:\Users\Admin\AppData\Local\Temp\7ef4fc1d192596b419ba320338f34c129eba80fe81ef4bb0c94fc6beba30178b.exe
"C:\Users\Admin\AppData\Local\Temp\7ef4fc1d192596b419ba320338f34c129eba80fe81ef4bb0c94fc6beba30178b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Users\Admin\AppData\Local\Temp\7ef4fc1d192596b419ba320338f34c129eba80fe81ef4bb0c94fc6beba30178b.exe
  "C:\Users\Admin\AppData\Local\Temp\7ef4fc1d192596b419ba320338f34c129eba80fe81ef4bb0c94fc6beba30178b.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Users\Admin\AppData\Local\Temp\fflnvackuxddlryaagiuuxdjltaemoou.com
    "C:\Users\Admin\AppData\Local\Temp\fflnvackuxddlryaagiuuxdjltaemoou.com"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3824
  - - C:\Users\Admin\AppData\Local\Temp\fflnvackuxddlryaagiuuxdjltaemoou.com
      "C:\Users\Admin\AppData\Local\Temp\fflnvackuxddlryaagiuuxdjltaemoou.com"
      4⤵
      Executes dropped EXE
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:228
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\syswow64\svchost.exe
        5⤵
        Adds policy Run key to start application
        Drops file in Program Files directory
        
        PID:856

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fflnvackuxddlryaagiuuxdjltaemoou.com

Filesize
143KB

MD5
64c4408a5e8063a53544b9e65e9e18d0

SHA1
37e5282d46379d55a2df82748f989194c8f3ebae

SHA256
b1243120e0046acc1ef0218e0d686f65557a83b187df795fefc809ea6927ac39

SHA512
53f860a52883da43acebc4c923ed01e83de0204b2112b24219b551174e50d68e13dec5bdd6d794a5e285bc3cb3e72aff24860f012533208af93b6191322acfd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fflnvackuxddlryaagiuuxdjltaemoou.com

Filesize
143KB

MD5
64c4408a5e8063a53544b9e65e9e18d0

SHA1
37e5282d46379d55a2df82748f989194c8f3ebae

SHA256
b1243120e0046acc1ef0218e0d686f65557a83b187df795fefc809ea6927ac39

SHA512
53f860a52883da43acebc4c923ed01e83de0204b2112b24219b551174e50d68e13dec5bdd6d794a5e285bc3cb3e72aff24860f012533208af93b6191322acfd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fflnvackuxddlryaagiuuxdjltaemoou.com

Filesize
143KB

MD5
64c4408a5e8063a53544b9e65e9e18d0

SHA1
37e5282d46379d55a2df82748f989194c8f3ebae

SHA256
b1243120e0046acc1ef0218e0d686f65557a83b187df795fefc809ea6927ac39

SHA512
53f860a52883da43acebc4c923ed01e83de0204b2112b24219b551174e50d68e13dec5bdd6d794a5e285bc3cb3e72aff24860f012533208af93b6191322acfd8

Download Submit
memory/228-147-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/228-144-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/856-149-0x0000000000130000-0x000000000013E000-memory.dmp

Filesize
56KB

Download
memory/856-150-0x0000000000630000-0x0000000000635000-memory.dmp

Filesize
20KB

Download
memory/856-151-0x0000000002BD0000-0x0000000002BE6000-memory.dmp

Filesize
88KB

Download
memory/856-152-0x0000000000630000-0x0000000000635000-memory.dmp

Filesize
20KB

Download
memory/1028-132-0x0000000000400000-0x00000000004D6000-memory.dmp

Filesize
856KB

Download
memory/1028-136-0x0000000000400000-0x00000000004D6000-memory.dmp

Filesize
856KB

Download
memory/1900-134-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1900-142-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1900-138-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1900-137-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing