199b10fb33ba812bd04f799d6ac2a72ef05c5c316496f43bfbb64aee67fcdaf0

General

Target

199b10fb33ba812bd04f799d6ac2a72ef05c5c316496f43bfbb64aee67fcdaf0.exe
Size

12.7MB
MD5

5bb596ef8c83f95b6620007c4186cb32
SHA1

594d0b82477af19750e76191c37a2edeea6aeb38
SHA256

199b10fb33ba812bd04f799d6ac2a72ef05c5c316496f43bfbb64aee67fcdaf0
SHA512

cc4ffb90c1be1eacccb16cf334bb6cd9f57372961c5640695e31e736f047de6136241965a1f6931517f11fa4802d7c85b28e033cdb94ca1b13b784f4ca1e5957
SSDEEP

393216:55oTHhuRQ8K8/M5hiAD5o3Rpa6f6l5SpUZ6:55oTHoRQ8KsM5QjC8m5SpUZ6

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
996	199b10fb33ba812bd04f799d6ac2a72ef05c5c316496f43bfbb64aee67fcdaf0.tmp

Loads dropped DLL 3 IoCs

pid	Process
1388	199b10fb33ba812bd04f799d6ac2a72ef05c5c316496f43bfbb64aee67fcdaf0.exe
996	199b10fb33ba812bd04f799d6ac2a72ef05c5c316496f43bfbb64aee67fcdaf0.tmp
996	199b10fb33ba812bd04f799d6ac2a72ef05c5c316496f43bfbb64aee67fcdaf0.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 2 IoCs

evasion

pid	Process
548	taskkill.exe
1736	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1736	taskkill.exe
Token: SeDebugPrivilege	548	taskkill.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 996	1388	199b10fb33ba812bd04f799d6ac2a72ef05c5c316496f43bfbb64aee67fcdaf0.exe	27
PID 1388 wrote to memory of 996	1388	199b10fb33ba812bd04f799d6ac2a72ef05c5c316496f43bfbb64aee67fcdaf0.exe	27
PID 1388 wrote to memory of 996	1388	199b10fb33ba812bd04f799d6ac2a72ef05c5c316496f43bfbb64aee67fcdaf0.exe	27
PID 1388 wrote to memory of 996	1388	199b10fb33ba812bd04f799d6ac2a72ef05c5c316496f43bfbb64aee67fcdaf0.exe	27
PID 1388 wrote to memory of 996	1388	199b10fb33ba812bd04f799d6ac2a72ef05c5c316496f43bfbb64aee67fcdaf0.exe	27
PID 1388 wrote to memory of 996	1388	199b10fb33ba812bd04f799d6ac2a72ef05c5c316496f43bfbb64aee67fcdaf0.exe	27
PID 1388 wrote to memory of 996	1388	199b10fb33ba812bd04f799d6ac2a72ef05c5c316496f43bfbb64aee67fcdaf0.exe	27
PID 996 wrote to memory of 1164	996	199b10fb33ba812bd04f799d6ac2a72ef05c5c316496f43bfbb64aee67fcdaf0.tmp	28
PID 996 wrote to memory of 1164	996	199b10fb33ba812bd04f799d6ac2a72ef05c5c316496f43bfbb64aee67fcdaf0.tmp	28
PID 996 wrote to memory of 1164	996	199b10fb33ba812bd04f799d6ac2a72ef05c5c316496f43bfbb64aee67fcdaf0.tmp	28
PID 996 wrote to memory of 1164	996	199b10fb33ba812bd04f799d6ac2a72ef05c5c316496f43bfbb64aee67fcdaf0.tmp	28
PID 1164 wrote to memory of 1736	1164	cmd.exe	30
PID 1164 wrote to memory of 1736	1164	cmd.exe	30
PID 1164 wrote to memory of 1736	1164	cmd.exe	30
PID 1164 wrote to memory of 1736	1164	cmd.exe	30
PID 996 wrote to memory of 1540	996	199b10fb33ba812bd04f799d6ac2a72ef05c5c316496f43bfbb64aee67fcdaf0.tmp	32
PID 996 wrote to memory of 1540	996	199b10fb33ba812bd04f799d6ac2a72ef05c5c316496f43bfbb64aee67fcdaf0.tmp	32
PID 996 wrote to memory of 1540	996	199b10fb33ba812bd04f799d6ac2a72ef05c5c316496f43bfbb64aee67fcdaf0.tmp	32
PID 996 wrote to memory of 1540	996	199b10fb33ba812bd04f799d6ac2a72ef05c5c316496f43bfbb64aee67fcdaf0.tmp	32
PID 1540 wrote to memory of 548	1540	cmd.exe	34
PID 1540 wrote to memory of 548	1540	cmd.exe	34
PID 1540 wrote to memory of 548	1540	cmd.exe	34
PID 1540 wrote to memory of 548	1540	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\199b10fb33ba812bd04f799d6ac2a72ef05c5c316496f43bfbb64aee67fcdaf0.exe
"C:\Users\Admin\AppData\Local\Temp\199b10fb33ba812bd04f799d6ac2a72ef05c5c316496f43bfbb64aee67fcdaf0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Users\Admin\AppData\Local\Temp\is-7PDJ6.tmp\199b10fb33ba812bd04f799d6ac2a72ef05c5c316496f43bfbb64aee67fcdaf0.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-7PDJ6.tmp\199b10fb33ba812bd04f799d6ac2a72ef05c5c316496f43bfbb64aee67fcdaf0.tmp" /SL5="$60124,13035711,76800,C:\Users\Admin\AppData\Local\Temp\199b10fb33ba812bd04f799d6ac2a72ef05c5c316496f43bfbb64aee67fcdaf0.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c taskkill /f /t /im HAss.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1164
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /t /im HAss.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1736
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c taskkill /f /t /im HAssService.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1540
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /t /im HAssService.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:548

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-7PDJ6.tmp\199b10fb33ba812bd04f799d6ac2a72ef05c5c316496f43bfbb64aee67fcdaf0.tmp

Filesize
922KB

MD5
ab1bd09a43bae984abb567ae4ab4eaf5

SHA1
9d72fe2b326e2200981c8d39d65bed82aea519f6

SHA256
ccd4f4878ca6a89807b6c1c2174e8b0d566d1e248714f1a5a098425b831a8694

SHA512
cd4a58404a62507214487574762fb7837f24ebaf246f85a8e9d9865980fdef431bab6846fa81324b5b35bf3d170f0f95a909865f73994c0a094b59cf02aed446

Download Submit
\Users\Admin\AppData\Local\Temp\is-7PDJ6.tmp\199b10fb33ba812bd04f799d6ac2a72ef05c5c316496f43bfbb64aee67fcdaf0.tmp

Filesize
922KB

MD5
ab1bd09a43bae984abb567ae4ab4eaf5

SHA1
9d72fe2b326e2200981c8d39d65bed82aea519f6

SHA256
ccd4f4878ca6a89807b6c1c2174e8b0d566d1e248714f1a5a098425b831a8694

SHA512
cd4a58404a62507214487574762fb7837f24ebaf246f85a8e9d9865980fdef431bab6846fa81324b5b35bf3d170f0f95a909865f73994c0a094b59cf02aed446

Download Submit
\Users\Admin\AppData\Local\Temp\is-RAL04.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-RAL04.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/1388-54-0x0000000075E11000-0x0000000075E13000-memory.dmp

Filesize
8KB

Download
memory/1388-55-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1388-65-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing