c0d34e51befb3a8063ab6b2bfdf130f07a7c3889ed6b0d0c557c5559fe5e656f

General

Target

c0d34e51befb3a8063ab6b2bfdf130f07a7c3889ed6b0d0c557c5559fe5e656f.exe
Size

448KB
MD5

3b311bb1c3c2a0616e525e87dbc1800f
SHA1

bc8ba842ec7b4c0a8996f28b3df880a7ab4ee2a4
SHA256

c0d34e51befb3a8063ab6b2bfdf130f07a7c3889ed6b0d0c557c5559fe5e656f
SHA512

f6d3a9fa091591d25c2110d14ded76118feebd8c13d1d18f99baae7fc16f59217b27852aa13e104a9536c7ee70b10e4736feb2591262f40ee8bee27ea21162d2
SSDEEP

3072:n0R1+aJe1mgawzxsBub861jIHxowJpstv5SVACakZF3S11YhAnqae2c6wsjeQA:n0RUTV5niStvL5kF3SYhuqp2c6ws

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
844	t2serv.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Loads dropped DLL 1 IoCs

pid	Process
844	t2serv.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\t2serv = "C:\\Windows\\t2serv.exe s"	t2serv.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msvfnetl.dll	t2serv.exe
File created	C:\Windows\SysWOW64\aclewmdm.dll	t2serv.exe
File created	C:\Windows\SysWOW64\kbdcs11t.exe	t2serv.exe
File created	C:\Windows\SysWOW64\e1.dll	t2serv.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\t2serv.exe	c0d34e51befb3a8063ab6b2bfdf130f07a7c3889ed6b0d0c557c5559fe5e656f.exe
File created	C:\Windows\t2serv.dll	t2serv.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1292	notepad.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
844	t2serv.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	844	t2serv.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
844	t2serv.exe
844	t2serv.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 844	1416	c0d34e51befb3a8063ab6b2bfdf130f07a7c3889ed6b0d0c557c5559fe5e656f.exe	27
PID 1416 wrote to memory of 844	1416	c0d34e51befb3a8063ab6b2bfdf130f07a7c3889ed6b0d0c557c5559fe5e656f.exe	27
PID 1416 wrote to memory of 844	1416	c0d34e51befb3a8063ab6b2bfdf130f07a7c3889ed6b0d0c557c5559fe5e656f.exe	27
PID 1416 wrote to memory of 844	1416	c0d34e51befb3a8063ab6b2bfdf130f07a7c3889ed6b0d0c557c5559fe5e656f.exe	27
PID 1416 wrote to memory of 1292	1416	c0d34e51befb3a8063ab6b2bfdf130f07a7c3889ed6b0d0c557c5559fe5e656f.exe	28
PID 1416 wrote to memory of 1292	1416	c0d34e51befb3a8063ab6b2bfdf130f07a7c3889ed6b0d0c557c5559fe5e656f.exe	28
PID 1416 wrote to memory of 1292	1416	c0d34e51befb3a8063ab6b2bfdf130f07a7c3889ed6b0d0c557c5559fe5e656f.exe	28
PID 1416 wrote to memory of 1292	1416	c0d34e51befb3a8063ab6b2bfdf130f07a7c3889ed6b0d0c557c5559fe5e656f.exe	28
PID 844 wrote to memory of 1284	844	t2serv.exe	16

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1284
- C:\Users\Admin\AppData\Local\Temp\c0d34e51befb3a8063ab6b2bfdf130f07a7c3889ed6b0d0c557c5559fe5e656f.exe
  "C:\Users\Admin\AppData\Local\Temp\c0d34e51befb3a8063ab6b2bfdf130f07a7c3889ed6b0d0c557c5559fe5e656f.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1416
- - C:\Windows\t2serv.exe
    C:\Windows\t2serv.exe s
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:844
- - C:\Windows\SysWOW64\notepad.exe
    C:\Windows\System32\notepad.exe C:\Users\Admin\AppData\Local\Temp\2C20.tmp
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:1292

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2C20.tmp

Filesize
55KB

MD5
f0e0ae615e8c27a819bab8c446c759c6

SHA1
ad587bfcbace34bf643aa493970fcd21d9939aa2

SHA256
34b05799f483162d3226347d9ad98e8fe7246d2b63ad3df38a583a52a772656c

SHA512
9fb0e4a930d3cf1b098993ecd1299cbd6aa6f8e1ee648b88aed45210495a0b970ec1cd67dd91e6267d3c0e2291fb0dba960b4949d138ba3fe0db88bcbeee961b

Download Submit
C:\Windows\t2serv.exe

Filesize
448KB

MD5
3b311bb1c3c2a0616e525e87dbc1800f

SHA1
bc8ba842ec7b4c0a8996f28b3df880a7ab4ee2a4

SHA256
c0d34e51befb3a8063ab6b2bfdf130f07a7c3889ed6b0d0c557c5559fe5e656f

SHA512
f6d3a9fa091591d25c2110d14ded76118feebd8c13d1d18f99baae7fc16f59217b27852aa13e104a9536c7ee70b10e4736feb2591262f40ee8bee27ea21162d2

Download Submit
\Windows\SysWOW64\aclewmdm.dll

Filesize
11KB

MD5
88fc1168f041dfe7b14e092f212f25c0

SHA1
16373601b4da5335538bb06fb99baa9a0085c5d0

SHA256
a76b7c09a406243e9193e15654f71fc14b6d8e8dd15d881ea42d8699abe712e7

SHA512
50a8d71d38961c7796f33b672ac7af8afb62e968106dcfdce9cbb31ac336de2f3d9e8f898265444af65f9326ce0830a29fcabe3f5ace906da7427bad18e56387

Download Submit
memory/844-60-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/844-64-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1292-59-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download
memory/1416-54-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1416-58-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download

Analysis

Sharing