70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d

General

Target

70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe
Size

685KB
MD5

0d318412812641ae760b7949d8037fef
SHA1

aa750898bad800bd21f7823eccb1e259f14c6ad7
SHA256

70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d
SHA512

7e6bc236b821dfa3938a6989a06b693831a78666eb9a78cc0021dfb2b40c91ad3473d5c46ad42acb286095e9ea4ccf28a81eb9b74efb2dbf957b9c9eddc49205
SSDEEP

12288:mfOMTqlIilNtVhyqGxwX0SC/OXVptKGA2WQ1+FGZMSefFb4XP96/t:mfTqlXxhVv0SC/4VbALSetb4Xo/t

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 22 IoCs

Processes:

70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe

description	ioc	process
File created	\??\c:\windows\SysWOW64\yytmp1\1949427463\lk1949427463.tmp	70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe
File created	\??\c:\windows\SysWOW64\yytmp1\1949427463\sx1949427463.tmp	70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe
File created	\??\c:\windows\SysWOW64\opfileOneA	70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe
File opened for modification	\??\c:\windows\SysWOW64\yytmp1\1949427463\1949427463.tmp	70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe
File opened for modification	\??\c:\windows\SysWOW64\yytmp1\1949427463\sx1949427463.tmp	70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe
File created	\??\c:\windows\SysWOW64\syys7.1.1.syw	70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe
File created	\??\c:\windows\SysWOW64\yytmp1\ywsinid.files\25.bmp	70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe
File opened for modification	\??\c:\windows\SysWOW64\yytmp1\ÓÑÒæÎÄÊé.exe	70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe
File created	\??\c:\windows\SysWOW64\opfilejlA	70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe
File opened for modification	\??\c:\windows\SysWOW64\yytmp1\1949427463\mu1949427463.tmp	70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe
File opened for modification	\??\c:\windows\SysWOW64\opfileOneA	70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe
File opened for modification	\??\c:\windows\SysWOW64\yytmp1\1949427463\lk1949427463.tmp	70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe
File opened for modification	\??\c:\windows\SysWOW64\yytmp1\1949427463\fj1949427463.tmp	70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe
File opened for modification	\??\c:\windows\SysWOW64\yytmp1\filebak	70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe
File opened for modification	\??\c:\windows\SysWOW64\opfilejlA	70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe
File created	\??\c:\windows\SysWOW64\yytmp1\1949427463\1949427463.tmp	70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe
File created	\??\c:\windows\SysWOW64\yytmp1\1949427463\fj1949427463.tmp	70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe
File created	\??\c:\windows\SysWOW64\yytmp1\ÓÑÒæÎÄÊé.exe	70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe
File created	\??\c:\windows\SysWOW64\yytmp1\ywsfiletmp.tmp	70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe
File created	\??\c:\windows\SysWOW64\yytmp1\1949427463\yadviser.tmp	70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe
File created	\??\c:\windows\SysWOW64\yytmp1\filebak	70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe
File created	\??\c:\windows\SysWOW64\yytmp1\1949427463\mu1949427463.tmp	70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 5 IoCs

Processes:

70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8	70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\EditFlags = "65536"	70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.Sheet.8\EditFlags = "65536"	70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\PowerPoint.Show.8\EditFlags = "65536"	70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ywsfile	70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe

pid	process
3464	70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe
3464	70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe

C:\Users\Admin\AppData\Local\Temp\70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe
"C:\Users\Admin\AppData\Local\Temp\70786c405b12307647ae71503dfd2865470d3d6bbc2aff41e17a89516bcfd28d.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3464

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\19296\9867\11322\1949427463\picgg.htm
Filesize
724B

MD5
78fcda30747bae4cc0f88ecaa02d8e9c

SHA1
192b386d90e0f0454bb8adb64e62bf30b1738c35

SHA256
9ed58c25f24e6455c3b5b2f72df05c8951f09876236542774b69497d04d5ad6c

SHA512
7117cdb0693c9cd034ec5898fca7ad3a1a5e99457b45904cbc5aec6d2b5b0e5a9f1b588db1b6fc082c86543e6bc35334fe547ede3bc5ee32bae9b7d4f8e7a041

Download Submit
C:\Users\Admin\AppData\Local\Temp\19296\9867\11322\1949427463\ywsinid
Filesize
115B

MD5
6425b53448f0dd761c3a1195bbabcf29

SHA1
2d4a1b3243cb6969ee0ebd5d2c622f40953634ea

SHA256
72eddc2a98b8e4fd8732bb60acdee3f0100912ee458f5fbe5c59c157e46d8ebd

SHA512
3de7d1a4ea8c9c0e2ec7e6824dd469ac592f3fb3cef9095d1bfd64fe383cf1855a8b947b3bf71854d11fdc4775dba94fe6e762a76536aa2b521da04df5ea51c9

Download Submit
memory/3464-133-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/3464-242-0x0000000000400000-0x00000000005A9000-memory.dmp

Filesize
1.7MB

Download
memory/3464-243-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads