610d7722e9af370ceaf66c692774e2361fc05bed43c28b2955e9e038c26a63fb

General

Target

610d7722e9af370ceaf66c692774e2361fc05bed43c28b2955e9e038c26a63fb.exe
Size

68KB
MD5

1d6c90d80ed41db48e6a4df1d4e474b0
SHA1

9b9bb111792fccdb55aad65d9823f17710816e36
SHA256

610d7722e9af370ceaf66c692774e2361fc05bed43c28b2955e9e038c26a63fb
SHA512

fcd1ae1fea1bd55df28c14c03a5dc0cbb2e66894edb200e22915a88fae594c39b72d05ac40232ff7e911fbf4920f3b953cb6f0a5df4e4981913f89d6693cbeb0
SSDEEP

1536:lAUg7Xm0RmNAtk4myu4H1epSF3P5i8EKwr:lwa04N6myue4u5Qlr

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	610d7722e9af370ceaf66c692774e2361fc05bed43c28b2955e9e038c26a63fb.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	610d7722e9af370ceaf66c692774e2361fc05bed43c28b2955e9e038c26a63fb.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	610d7722e9af370ceaf66c692774e2361fc05bed43c28b2955e9e038c26a63fb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\P-7-78-8964-9648-3874\winusm.exe	610d7722e9af370ceaf66c692774e2361fc05bed43c28b2955e9e038c26a63fb.exe

Executes dropped EXE 2 IoCs

pid	Process
2276	winusm.exe
4836	winusm.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	610d7722e9af370ceaf66c692774e2361fc05bed43c28b2955e9e038c26a63fb.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows System = "C:\\Users\\Admin\\P-7-78-8964-9648-3874\\winusm.exe"	610d7722e9af370ceaf66c692774e2361fc05bed43c28b2955e9e038c26a63fb.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4872 set thread context of 5116	4872	610d7722e9af370ceaf66c692774e2361fc05bed43c28b2955e9e038c26a63fb.exe	82
PID 2276 set thread context of 4836	2276	winusm.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	610d7722e9af370ceaf66c692774e2361fc05bed43c28b2955e9e038c26a63fb.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 5116	4872	610d7722e9af370ceaf66c692774e2361fc05bed43c28b2955e9e038c26a63fb.exe	82
PID 4872 wrote to memory of 5116	4872	610d7722e9af370ceaf66c692774e2361fc05bed43c28b2955e9e038c26a63fb.exe	82
PID 4872 wrote to memory of 5116	4872	610d7722e9af370ceaf66c692774e2361fc05bed43c28b2955e9e038c26a63fb.exe	82
PID 4872 wrote to memory of 5116	4872	610d7722e9af370ceaf66c692774e2361fc05bed43c28b2955e9e038c26a63fb.exe	82
PID 4872 wrote to memory of 5116	4872	610d7722e9af370ceaf66c692774e2361fc05bed43c28b2955e9e038c26a63fb.exe	82
PID 4872 wrote to memory of 5116	4872	610d7722e9af370ceaf66c692774e2361fc05bed43c28b2955e9e038c26a63fb.exe	82
PID 4872 wrote to memory of 5116	4872	610d7722e9af370ceaf66c692774e2361fc05bed43c28b2955e9e038c26a63fb.exe	82
PID 4872 wrote to memory of 5116	4872	610d7722e9af370ceaf66c692774e2361fc05bed43c28b2955e9e038c26a63fb.exe	82
PID 5116 wrote to memory of 2276	5116	610d7722e9af370ceaf66c692774e2361fc05bed43c28b2955e9e038c26a63fb.exe	83
PID 5116 wrote to memory of 2276	5116	610d7722e9af370ceaf66c692774e2361fc05bed43c28b2955e9e038c26a63fb.exe	83
PID 5116 wrote to memory of 2276	5116	610d7722e9af370ceaf66c692774e2361fc05bed43c28b2955e9e038c26a63fb.exe	83
PID 2276 wrote to memory of 4836	2276	winusm.exe	84
PID 2276 wrote to memory of 4836	2276	winusm.exe	84
PID 2276 wrote to memory of 4836	2276	winusm.exe	84
PID 2276 wrote to memory of 4836	2276	winusm.exe	84
PID 2276 wrote to memory of 4836	2276	winusm.exe	84
PID 2276 wrote to memory of 4836	2276	winusm.exe	84
PID 2276 wrote to memory of 4836	2276	winusm.exe	84
PID 2276 wrote to memory of 4836	2276	winusm.exe	84

C:\Users\Admin\AppData\Local\Temp\610d7722e9af370ceaf66c692774e2361fc05bed43c28b2955e9e038c26a63fb.exe
"C:\Users\Admin\AppData\Local\Temp\610d7722e9af370ceaf66c692774e2361fc05bed43c28b2955e9e038c26a63fb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Users\Admin\AppData\Local\Temp\610d7722e9af370ceaf66c692774e2361fc05bed43c28b2955e9e038c26a63fb.exe
  C:\Users\Admin\AppData\Local\Temp\610d7722e9af370ceaf66c692774e2361fc05bed43c28b2955e9e038c26a63fb.exe
  2⤵
  - Modifies firewall policy service
  - Checks computer location settings
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Users\Admin\P-7-78-8964-9648-3874\winusm.exe
    "C:\Users\Admin\P-7-78-8964-9648-3874\winusm.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2276
  - - C:\Users\Admin\P-7-78-8964-9648-3874\winusm.exe
      C:\Users\Admin\P-7-78-8964-9648-3874\winusm.exe
      4⤵
      Executes dropped EXE
      PID:4836

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\P-7-78-8964-9648-3874\winusm.exe

Filesize
68KB

MD5
1d6c90d80ed41db48e6a4df1d4e474b0

SHA1
9b9bb111792fccdb55aad65d9823f17710816e36

SHA256
610d7722e9af370ceaf66c692774e2361fc05bed43c28b2955e9e038c26a63fb

SHA512
fcd1ae1fea1bd55df28c14c03a5dc0cbb2e66894edb200e22915a88fae594c39b72d05ac40232ff7e911fbf4920f3b953cb6f0a5df4e4981913f89d6693cbeb0

Download Submit
C:\Users\Admin\P-7-78-8964-9648-3874\winusm.exe

Filesize
68KB

MD5
1d6c90d80ed41db48e6a4df1d4e474b0

SHA1
9b9bb111792fccdb55aad65d9823f17710816e36

SHA256
610d7722e9af370ceaf66c692774e2361fc05bed43c28b2955e9e038c26a63fb

SHA512
fcd1ae1fea1bd55df28c14c03a5dc0cbb2e66894edb200e22915a88fae594c39b72d05ac40232ff7e911fbf4920f3b953cb6f0a5df4e4981913f89d6693cbeb0

Download Submit
C:\Users\Admin\P-7-78-8964-9648-3874\winusm.exe

Filesize
68KB

MD5
1d6c90d80ed41db48e6a4df1d4e474b0

SHA1
9b9bb111792fccdb55aad65d9823f17710816e36

SHA256
610d7722e9af370ceaf66c692774e2361fc05bed43c28b2955e9e038c26a63fb

SHA512
fcd1ae1fea1bd55df28c14c03a5dc0cbb2e66894edb200e22915a88fae594c39b72d05ac40232ff7e911fbf4920f3b953cb6f0a5df4e4981913f89d6693cbeb0

Download Submit
memory/2276-138-0x0000000000000000-mapping.dmp

Download
memory/4836-141-0x0000000000000000-mapping.dmp

Download
memory/5116-132-0x0000000000000000-mapping.dmp

Download
memory/5116-133-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/5116-135-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/5116-136-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/5116-137-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads