915414113bb65a00faebb46f147e7a1ba14a0a9c8b11f139bdc9f41dccb3a43e

General

Target

915414113bb65a00faebb46f147e7a1ba14a0a9c8b11f139bdc9f41dccb3a43e.exe
Size

52KB
MD5

d5c51c074723a1a26101973e6a01254d
SHA1

52cb12a0ca37297478f14d11072a922ec4a41195
SHA256

915414113bb65a00faebb46f147e7a1ba14a0a9c8b11f139bdc9f41dccb3a43e
SHA512

748b890f02805bbd9cf8289245ea7331356ef157b9910781c69116a4935cd7aecf479d349dff779706e4a4ade799f6914e582a025571e0cc140d6f31f6f10fb8
SSDEEP

1536:gExDPQ9l3ky88x8vTJJ16mQhfWrTflItYtb:VxE9BkX8evTJJmsTflItYtb

Score

10^/10

evasion

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	915414113bb65a00faebb46f147e7a1ba14a0a9c8b11f139bdc9f41dccb3a43e.exe

Executes dropped EXE 1 IoCs

pid	Process
900	main.exe

Loads dropped DLL 5 IoCs

pid	Process
1200	915414113bb65a00faebb46f147e7a1ba14a0a9c8b11f139bdc9f41dccb3a43e.exe
1200	915414113bb65a00faebb46f147e7a1ba14a0a9c8b11f139bdc9f41dccb3a43e.exe
900	main.exe
900	main.exe
900	main.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\taoY.ico	915414113bb65a00faebb46f147e7a1ba14a0a9c8b11f139bdc9f41dccb3a43e.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Messenger\Messenger.kvh	915414113bb65a00faebb46f147e7a1ba14a0a9c8b11f139bdc9f41dccb3a43e.exe
File created	C:\Program Files (x86)\Optimize\main.exe	915414113bb65a00faebb46f147e7a1ba14a0a9c8b11f139bdc9f41dccb3a43e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.kvh	915414113bb65a00faebb46f147e7a1ba14a0a9c8b11f139bdc9f41dccb3a43e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.kvh\ = "JSEFile"	915414113bb65a00faebb46f147e7a1ba14a0a9c8b11f139bdc9f41dccb3a43e.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 900	1200	915414113bb65a00faebb46f147e7a1ba14a0a9c8b11f139bdc9f41dccb3a43e.exe	27
PID 1200 wrote to memory of 900	1200	915414113bb65a00faebb46f147e7a1ba14a0a9c8b11f139bdc9f41dccb3a43e.exe	27
PID 1200 wrote to memory of 900	1200	915414113bb65a00faebb46f147e7a1ba14a0a9c8b11f139bdc9f41dccb3a43e.exe	27
PID 1200 wrote to memory of 900	1200	915414113bb65a00faebb46f147e7a1ba14a0a9c8b11f139bdc9f41dccb3a43e.exe	27
PID 1200 wrote to memory of 900	1200	915414113bb65a00faebb46f147e7a1ba14a0a9c8b11f139bdc9f41dccb3a43e.exe	27
PID 1200 wrote to memory of 900	1200	915414113bb65a00faebb46f147e7a1ba14a0a9c8b11f139bdc9f41dccb3a43e.exe	27
PID 1200 wrote to memory of 900	1200	915414113bb65a00faebb46f147e7a1ba14a0a9c8b11f139bdc9f41dccb3a43e.exe	27

C:\Users\Admin\AppData\Local\Temp\915414113bb65a00faebb46f147e7a1ba14a0a9c8b11f139bdc9f41dccb3a43e.exe
"C:\Users\Admin\AppData\Local\Temp\915414113bb65a00faebb46f147e7a1ba14a0a9c8b11f139bdc9f41dccb3a43e.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Program Files (x86)\Optimize\main.exe
  "C:\Program Files (x86)\Optimize\main.exe" "C:\Program Files (x86)\Messenger\messenger.kvh"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Messenger\messenger.kvh

Filesize
10KB

MD5
147add3dfd6e3e636e7756c674dead4b

SHA1
aa50f047f5d41086a9fad12ba1149a4e7d4fd6ad

SHA256
7ca5d56eb7433065bef86e42cc32fc9c222708ca9dd448da5b6a8c09f06e183f

SHA512
20eded712e509e439553ec752c62f5d157e6402fe2e2a09377cb59dea2c68aabdc6567a95790cd235d47799e9397f0abb6c028e9ede5dfae45cc945843baa650

Download Submit
C:\Program Files (x86)\Optimize\main.exe

Filesize
138KB

MD5
d1ab72db2bedd2f255d35da3da0d4b16

SHA1
860265276b29b42b8c4b077e5c651def9c81b6e9

SHA256
047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0

SHA512
b46830742eebc85e731c14f7dc72cc6734fcc79aab46f6080c95589c438c4cca0a069027badc0a8a78e4deeb31cdf38df3d63db679b793212a32efdad7bb8185

Download Submit
C:\Program Files (x86)\Optimize\main.exe

Filesize
138KB

MD5
d1ab72db2bedd2f255d35da3da0d4b16

SHA1
860265276b29b42b8c4b077e5c651def9c81b6e9

SHA256
047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0

SHA512
b46830742eebc85e731c14f7dc72cc6734fcc79aab46f6080c95589c438c4cca0a069027badc0a8a78e4deeb31cdf38df3d63db679b793212a32efdad7bb8185

Download Submit
\Program Files (x86)\Optimize\main.exe

Filesize
138KB

MD5
d1ab72db2bedd2f255d35da3da0d4b16

SHA1
860265276b29b42b8c4b077e5c651def9c81b6e9

SHA256
047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0

SHA512
b46830742eebc85e731c14f7dc72cc6734fcc79aab46f6080c95589c438c4cca0a069027badc0a8a78e4deeb31cdf38df3d63db679b793212a32efdad7bb8185

Download Submit
\Program Files (x86)\Optimize\main.exe

Filesize
138KB

MD5
d1ab72db2bedd2f255d35da3da0d4b16

SHA1
860265276b29b42b8c4b077e5c651def9c81b6e9

SHA256
047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0

SHA512
b46830742eebc85e731c14f7dc72cc6734fcc79aab46f6080c95589c438c4cca0a069027badc0a8a78e4deeb31cdf38df3d63db679b793212a32efdad7bb8185

Download Submit
\Program Files (x86)\Optimize\main.exe

Filesize
138KB

MD5
d1ab72db2bedd2f255d35da3da0d4b16

SHA1
860265276b29b42b8c4b077e5c651def9c81b6e9

SHA256
047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0

SHA512
b46830742eebc85e731c14f7dc72cc6734fcc79aab46f6080c95589c438c4cca0a069027badc0a8a78e4deeb31cdf38df3d63db679b793212a32efdad7bb8185

Download Submit
\Program Files (x86)\Optimize\main.exe

Filesize
138KB

MD5
d1ab72db2bedd2f255d35da3da0d4b16

SHA1
860265276b29b42b8c4b077e5c651def9c81b6e9

SHA256
047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0

SHA512
b46830742eebc85e731c14f7dc72cc6734fcc79aab46f6080c95589c438c4cca0a069027badc0a8a78e4deeb31cdf38df3d63db679b793212a32efdad7bb8185

Download Submit
\Program Files (x86)\Optimize\main.exe

Filesize
138KB

MD5
d1ab72db2bedd2f255d35da3da0d4b16

SHA1
860265276b29b42b8c4b077e5c651def9c81b6e9

SHA256
047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0

SHA512
b46830742eebc85e731c14f7dc72cc6734fcc79aab46f6080c95589c438c4cca0a069027badc0a8a78e4deeb31cdf38df3d63db679b793212a32efdad7bb8185

Download Submit
memory/900-57-0x0000000000000000-mapping.dmp

Download
memory/1200-54-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads