3ccb32deb2e0f0c8426041bec7e2baf86f7e87cfb770f0572535f4d28fd4bf09

General

Target

3ccb32deb2e0f0c8426041bec7e2baf86f7e87cfb770f0572535f4d28fd4bf09.exe
Size

1000KB
MD5

439dfb1848c5a06c0d88832381ed6bf0
SHA1

bf1cfdbf53f1c3ac5c01ad6ea65ec095fef198be
SHA256

3ccb32deb2e0f0c8426041bec7e2baf86f7e87cfb770f0572535f4d28fd4bf09
SHA512

5a31bed7753807fe61ede883a8fadaef2782581d917421ebacebc56b35dc834a39ede26161617cd82ddc7b467de45ad34cd7acf6e1ebe125d0ca9369dc3f97f5
SSDEEP

24576:W2O/Gl+vyZZ9GTbowtu/w9+uokjG/ZyNB5+Ct21X1p5p21IpGF:+yZnGTbosu/MozjCt21luIpQ

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1920	939393_.exe
5036	939393_.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	3ccb32deb2e0f0c8426041bec7e2baf86f7e87cfb770f0572535f4d28fd4bf09.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelp.exe	939393_.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelp.exe	939393_.exe

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0004000000022de7-136.dat	autoit_exe
behavioral2/files/0x0004000000022de7-137.dat	autoit_exe
behavioral2/files/0x0004000000022de7-140.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1920 set thread context of 5036	1920	939393_.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
5036	939393_.exe
5036	939393_.exe
5036	939393_.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
5036	939393_.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5036	939393_.exe
Token: SeDebugPrivilege	5036	939393_.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1920	939393_.exe
1920	939393_.exe
1920	939393_.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1920	939393_.exe
1920	939393_.exe
1920	939393_.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 1920	1508	3ccb32deb2e0f0c8426041bec7e2baf86f7e87cfb770f0572535f4d28fd4bf09.exe	81
PID 1508 wrote to memory of 1920	1508	3ccb32deb2e0f0c8426041bec7e2baf86f7e87cfb770f0572535f4d28fd4bf09.exe	81
PID 1508 wrote to memory of 1920	1508	3ccb32deb2e0f0c8426041bec7e2baf86f7e87cfb770f0572535f4d28fd4bf09.exe	81
PID 1920 wrote to memory of 5036	1920	939393_.exe	83
PID 1920 wrote to memory of 5036	1920	939393_.exe	83
PID 1920 wrote to memory of 5036	1920	939393_.exe	83
PID 1920 wrote to memory of 5036	1920	939393_.exe	83
PID 1920 wrote to memory of 5036	1920	939393_.exe	83
PID 1920 wrote to memory of 5036	1920	939393_.exe	83
PID 1920 wrote to memory of 5036	1920	939393_.exe	83
PID 1920 wrote to memory of 5036	1920	939393_.exe	83
PID 5036 wrote to memory of 2392	5036	939393_.exe	84
PID 5036 wrote to memory of 2392	5036	939393_.exe	84

C:\Users\Admin\AppData\Local\Temp\3ccb32deb2e0f0c8426041bec7e2baf86f7e87cfb770f0572535f4d28fd4bf09.exe
"C:\Users\Admin\AppData\Local\Temp\3ccb32deb2e0f0c8426041bec7e2baf86f7e87cfb770f0572535f4d28fd4bf09.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Users\Admin\AppData\Local\Temp\939393_.exe
  "C:\Users\Admin\AppData\Local\Temp\939393_.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Users\Admin\AppData\Local\Temp\939393_.exe
    "C:\Users\Admin\AppData\Local\Temp\939393_.exe"
    3⤵
    - Executes dropped EXE
    - Drops startup file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5036
  - - C:\Windows\explorer.exe
      C:\Windows\explorer.exe
      4⤵
      PID:2392

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\939393_.exe

Filesize
1.0MB

MD5
4045f06e04e9ff5b61f972b686bcd053

SHA1
1a3b07afd6921fbf6e3cada9633b9117ef787fbe

SHA256
71d0488c7c53908429417da06d40ff4b72af7a050e35c6c9e284252a01fa6634

SHA512
17ae36f0f5a93bbec80a1dd7325503dab719b90482a8b129f0bd7e36e3042017060536be2acb2c0212d0628bf80e5cb7fd7cb547b754a4a51039e34d517a03dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\939393_.exe

Filesize
1.0MB

MD5
4045f06e04e9ff5b61f972b686bcd053

SHA1
1a3b07afd6921fbf6e3cada9633b9117ef787fbe

SHA256
71d0488c7c53908429417da06d40ff4b72af7a050e35c6c9e284252a01fa6634

SHA512
17ae36f0f5a93bbec80a1dd7325503dab719b90482a8b129f0bd7e36e3042017060536be2acb2c0212d0628bf80e5cb7fd7cb547b754a4a51039e34d517a03dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\939393_.exe

Filesize
1.0MB

MD5
4045f06e04e9ff5b61f972b686bcd053

SHA1
1a3b07afd6921fbf6e3cada9633b9117ef787fbe

SHA256
71d0488c7c53908429417da06d40ff4b72af7a050e35c6c9e284252a01fa6634

SHA512
17ae36f0f5a93bbec80a1dd7325503dab719b90482a8b129f0bd7e36e3042017060536be2acb2c0212d0628bf80e5cb7fd7cb547b754a4a51039e34d517a03dc

Download Submit
memory/5036-139-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5036-142-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5036-143-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing