c0d34e51befb3a8063ab6b2bfdf130f07a7c3889ed6b0d0c557c5559fe5e656f

General

Target

c0d34e51befb3a8063ab6b2bfdf130f07a7c3889ed6b0d0c557c5559fe5e656f.exe
Size

448KB
MD5

3b311bb1c3c2a0616e525e87dbc1800f
SHA1

bc8ba842ec7b4c0a8996f28b3df880a7ab4ee2a4
SHA256

c0d34e51befb3a8063ab6b2bfdf130f07a7c3889ed6b0d0c557c5559fe5e656f
SHA512

f6d3a9fa091591d25c2110d14ded76118feebd8c13d1d18f99baae7fc16f59217b27852aa13e104a9536c7ee70b10e4736feb2591262f40ee8bee27ea21162d2
SSDEEP

3072:n0R1+aJe1mgawzxsBub861jIHxowJpstv5SVACakZF3S11YhAnqae2c6wsjeQA:n0RUTV5niStvL5kF3SYhuqp2c6ws

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4452	t2serv.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Loads dropped DLL 3 IoCs

pid	Process
4452	t2serv.exe
4452	t2serv.exe
4452	t2serv.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\t2serv = "C:\\Windows\\t2serv.exe s"	t2serv.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msvfnetl.dll	t2serv.exe
File created	C:\Windows\SysWOW64\aclewmdm.dll	t2serv.exe
File created	C:\Windows\SysWOW64\kbdcs11t.exe	t2serv.exe
File created	C:\Windows\SysWOW64\e1.dll	t2serv.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\t2serv.dll	t2serv.exe
File created	C:\Windows\t2serv.exe	c0d34e51befb3a8063ab6b2bfdf130f07a7c3889ed6b0d0c557c5559fe5e656f.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4704	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4452	t2serv.exe
4452	t2serv.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4452	t2serv.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4452	t2serv.exe
4452	t2serv.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 4452	2020	c0d34e51befb3a8063ab6b2bfdf130f07a7c3889ed6b0d0c557c5559fe5e656f.exe	79
PID 2020 wrote to memory of 4452	2020	c0d34e51befb3a8063ab6b2bfdf130f07a7c3889ed6b0d0c557c5559fe5e656f.exe	79
PID 2020 wrote to memory of 4452	2020	c0d34e51befb3a8063ab6b2bfdf130f07a7c3889ed6b0d0c557c5559fe5e656f.exe	79
PID 2020 wrote to memory of 4704	2020	c0d34e51befb3a8063ab6b2bfdf130f07a7c3889ed6b0d0c557c5559fe5e656f.exe	80
PID 2020 wrote to memory of 4704	2020	c0d34e51befb3a8063ab6b2bfdf130f07a7c3889ed6b0d0c557c5559fe5e656f.exe	80
PID 2020 wrote to memory of 4704	2020	c0d34e51befb3a8063ab6b2bfdf130f07a7c3889ed6b0d0c557c5559fe5e656f.exe	80
PID 4452 wrote to memory of 792	4452	t2serv.exe	45

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:792
- C:\Users\Admin\AppData\Local\Temp\c0d34e51befb3a8063ab6b2bfdf130f07a7c3889ed6b0d0c557c5559fe5e656f.exe
  "C:\Users\Admin\AppData\Local\Temp\c0d34e51befb3a8063ab6b2bfdf130f07a7c3889ed6b0d0c557c5559fe5e656f.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\t2serv.exe
    C:\Windows\t2serv.exe s
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4452
- - C:\Windows\SysWOW64\notepad.exe
    C:\Windows\System32\notepad.exe C:\Users\Admin\AppData\Local\Temp\3EF5.tmp
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:4704

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3EF5.tmp

Filesize
85KB

MD5
0aa85db0aa7ebf5f7e4914509aa68f71

SHA1
896be987302105a395298561449be2753381424c

SHA256
28e4a7a0945c479acccff9441d6eafaf424359061aaafe13e7431af731b86f39

SHA512
765513d3cd78fec1c2fa13b69e19e0072b06f49f8a427f6c98a7d2ab216c59aa5545f53e1a70f8efdf6bf03c25f24429d82175b54f647adb66c84867394c9aad

Download Submit
C:\Windows\SysWOW64\aclewmdm.dll

Filesize
11KB

MD5
88fc1168f041dfe7b14e092f212f25c0

SHA1
16373601b4da5335538bb06fb99baa9a0085c5d0

SHA256
a76b7c09a406243e9193e15654f71fc14b6d8e8dd15d881ea42d8699abe712e7

SHA512
50a8d71d38961c7796f33b672ac7af8afb62e968106dcfdce9cbb31ac336de2f3d9e8f898265444af65f9326ce0830a29fcabe3f5ace906da7427bad18e56387

Download Submit
C:\Windows\t2serv.dll

Filesize
6KB

MD5
adf5226b3ee811f041810f99242c814e

SHA1
099e7de40e89cdc838de38a292b6224bac5d3600

SHA256
c2fa7c5b14e7033696a4e4475517bd58f589c5591293b73e45adb856749abace

SHA512
9ef3c4a32aeea2417b60aa669808cd0d085a7e77039ea6eadead7a998e8052feaf9ca07b66211703f2faf9eb01b2f164de7725ecd43a9317418fd0d48be95f6b

Download Submit
C:\Windows\t2serv.dll

Filesize
6KB

MD5
adf5226b3ee811f041810f99242c814e

SHA1
099e7de40e89cdc838de38a292b6224bac5d3600

SHA256
c2fa7c5b14e7033696a4e4475517bd58f589c5591293b73e45adb856749abace

SHA512
9ef3c4a32aeea2417b60aa669808cd0d085a7e77039ea6eadead7a998e8052feaf9ca07b66211703f2faf9eb01b2f164de7725ecd43a9317418fd0d48be95f6b

Download Submit
C:\Windows\t2serv.exe

Filesize
448KB

MD5
3b311bb1c3c2a0616e525e87dbc1800f

SHA1
bc8ba842ec7b4c0a8996f28b3df880a7ab4ee2a4

SHA256
c0d34e51befb3a8063ab6b2bfdf130f07a7c3889ed6b0d0c557c5559fe5e656f

SHA512
f6d3a9fa091591d25c2110d14ded76118feebd8c13d1d18f99baae7fc16f59217b27852aa13e104a9536c7ee70b10e4736feb2591262f40ee8bee27ea21162d2

Download Submit
C:\Windows\t2serv.exe

Filesize
448KB

MD5
3b311bb1c3c2a0616e525e87dbc1800f

SHA1
bc8ba842ec7b4c0a8996f28b3df880a7ab4ee2a4

SHA256
c0d34e51befb3a8063ab6b2bfdf130f07a7c3889ed6b0d0c557c5559fe5e656f

SHA512
f6d3a9fa091591d25c2110d14ded76118feebd8c13d1d18f99baae7fc16f59217b27852aa13e104a9536c7ee70b10e4736feb2591262f40ee8bee27ea21162d2

Download Submit
memory/2020-138-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2020-132-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2020-133-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/4452-140-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/4452-141-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download

Analysis

Sharing