179b98e2cb16a094755f853ae892b47948a8b6a83e7ca050d520e113ff180b2f

General

Target

tmpws5_15mx.exe
Size

1.0MB
MD5

5cc392e63c3dc70a7c7f4df36b2e8766
SHA1

b22002653deb3a96c5254fb9eb24f2b3c631471a
SHA256

179b98e2cb16a094755f853ae892b47948a8b6a83e7ca050d520e113ff180b2f
SHA512

7f9d5794c98c720f1797ccad7bde2ece513576676edd1aef4ed2bd6cf6ca0eb846d98d2dd404564d7a6b3a21484d314ecf0b01af103166e5a908ff59bff0507f
SSDEEP

24576:x41pyeFLdKeWjA1v+rArY/GRyaYNPZkfJFjm/97b:/udKeWWoAUOwaYNPZoJ6

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1832	control.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1428 set thread context of 1548	1428	tmpws5_15mx.exe	32
PID 1548 set thread context of 1272	1548	RegSvcs.exe	14
PID 1832 set thread context of 1272	1832	control.exe	14

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1148	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2647223082-2067913677-935928954-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	control.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
1428	tmpws5_15mx.exe
1428	tmpws5_15mx.exe
1548	RegSvcs.exe
1548	RegSvcs.exe
1548	RegSvcs.exe
1548	RegSvcs.exe
1464	powershell.exe
1832	control.exe
1832	control.exe
1832	control.exe
1832	control.exe
1832	control.exe
1832	control.exe
1832	control.exe
1832	control.exe
1832	control.exe
1832	control.exe
1832	control.exe
1832	control.exe
1832	control.exe
1832	control.exe
1832	control.exe
1832	control.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1272	Explorer.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
1548	RegSvcs.exe
1548	RegSvcs.exe
1548	RegSvcs.exe
1832	control.exe
1832	control.exe
1832	control.exe
1832	control.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1428	tmpws5_15mx.exe
Token: SeDebugPrivilege	1548	RegSvcs.exe
Token: SeDebugPrivilege	1464	powershell.exe
Token: SeDebugPrivilege	1832	control.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1272	Explorer.EXE
1272	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1272	Explorer.EXE
1272	Explorer.EXE

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 1464	1428	tmpws5_15mx.exe	28
PID 1428 wrote to memory of 1464	1428	tmpws5_15mx.exe	28
PID 1428 wrote to memory of 1464	1428	tmpws5_15mx.exe	28
PID 1428 wrote to memory of 1464	1428	tmpws5_15mx.exe	28
PID 1428 wrote to memory of 1148	1428	tmpws5_15mx.exe	30
PID 1428 wrote to memory of 1148	1428	tmpws5_15mx.exe	30
PID 1428 wrote to memory of 1148	1428	tmpws5_15mx.exe	30
PID 1428 wrote to memory of 1148	1428	tmpws5_15mx.exe	30
PID 1428 wrote to memory of 1548	1428	tmpws5_15mx.exe	32
PID 1428 wrote to memory of 1548	1428	tmpws5_15mx.exe	32
PID 1428 wrote to memory of 1548	1428	tmpws5_15mx.exe	32
PID 1428 wrote to memory of 1548	1428	tmpws5_15mx.exe	32
PID 1428 wrote to memory of 1548	1428	tmpws5_15mx.exe	32
PID 1428 wrote to memory of 1548	1428	tmpws5_15mx.exe	32
PID 1428 wrote to memory of 1548	1428	tmpws5_15mx.exe	32
PID 1428 wrote to memory of 1548	1428	tmpws5_15mx.exe	32
PID 1428 wrote to memory of 1548	1428	tmpws5_15mx.exe	32
PID 1428 wrote to memory of 1548	1428	tmpws5_15mx.exe	32
PID 1272 wrote to memory of 1832	1272	Explorer.EXE	33
PID 1272 wrote to memory of 1832	1272	Explorer.EXE	33
PID 1272 wrote to memory of 1832	1272	Explorer.EXE	33
PID 1272 wrote to memory of 1832	1272	Explorer.EXE	33
PID 1832 wrote to memory of 1340	1832	control.exe	36
PID 1832 wrote to memory of 1340	1832	control.exe	36
PID 1832 wrote to memory of 1340	1832	control.exe	36
PID 1832 wrote to memory of 1340	1832	control.exe	36
PID 1832 wrote to memory of 1340	1832	control.exe	36

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Users\Admin\AppData\Local\Temp\tmpws5_15mx.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpws5_15mx.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\veFVEmuTYkjoV.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1464
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\veFVEmuTYkjoV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB887.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1148
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1548
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\SysWOW64\control.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1340

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\axy0-.zip

Filesize
465KB

MD5
9e480b43cbe052e9ab25a0b982132e4d

SHA1
511ed863e48b8755e43b093238b923339c1bf846

SHA256
d76c2b3b27f279cbaabaa2d53c93e4bb7f2d8336e5aff7c74d7a16a2dbfbfb1c

SHA512
92a2753d125fec5a77945a1724dd85d07fd672583666029e313903584cf8e872fae9f3bb1db00cb9cde747edd4e3e95c8ffc3aa2867ce9212504d557e2adc8fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB887.tmp

Filesize
1KB

MD5
ca0cdb3e597a1cf0dafb599a3412ad62

SHA1
7b8531c54909773a1c6ef13f7e3c39a73a255866

SHA256
4bda957bfbf22b0abac6c864c636c1a503ae9073aeb5f80ea90ced237032164b

SHA512
87d2f7115da57ec56d3969fce425cd852ea625ba486bdcd460a87e50b4e055072644b014ce56b4bb69596389ce0cefcb8fee5436b753e59b56f9355f818175ea

Download Submit
\Users\Admin\AppData\Local\Temp\sqlite3.dll

Filesize
890KB

MD5
8402a6aa76d7787ff03943dd129e3d83

SHA1
895338cb761d62930ca93918011fd2cd33d5b30c

SHA256
49ff99d5b24f4f7d5a8ea175f35a6548c74b04e5c621c60121b5088dab19b4eb

SHA512
39bbe90385be35492825929296aae771fb4afb00a1f6a48f0e4ec17bc1097c3a32cea3b22033116c82695e66acbd6c847483a8da21e7302240467b58e39169ea

Download Submit
memory/1272-72-0x0000000003AF0000-0x0000000003CF0000-memory.dmp

Filesize
2.0MB

Download
memory/1272-88-0x0000000005FA0000-0x0000000006062000-memory.dmp

Filesize
776KB

Download
memory/1272-84-0x0000000005FA0000-0x0000000006062000-memory.dmp

Filesize
776KB

Download
memory/1272-79-0x0000000004970000-0x0000000004A51000-memory.dmp

Filesize
900KB

Download
memory/1428-58-0x00000000071C0000-0x0000000007270000-memory.dmp

Filesize
704KB

Download
memory/1428-57-0x0000000001F80000-0x0000000001F8C000-memory.dmp

Filesize
48KB

Download
memory/1428-64-0x0000000008060000-0x0000000008098000-memory.dmp

Filesize
224KB

Download
memory/1428-56-0x00000000004F0000-0x000000000050C000-memory.dmp

Filesize
112KB

Download
memory/1428-55-0x00000000070D0000-0x0000000007110000-memory.dmp

Filesize
256KB

Download
memory/1428-54-0x0000000000390000-0x00000000004A4000-memory.dmp

Filesize
1.1MB

Download
memory/1464-78-0x0000000002140000-0x0000000002180000-memory.dmp

Filesize
256KB

Download
memory/1464-73-0x0000000002140000-0x0000000002180000-memory.dmp

Filesize
256KB

Download
memory/1464-75-0x0000000002140000-0x0000000002180000-memory.dmp

Filesize
256KB

Download
memory/1548-74-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1548-70-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1548-76-0x0000000000820000-0x0000000000B23000-memory.dmp

Filesize
3.0MB

Download
memory/1548-71-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1548-77-0x0000000000090000-0x00000000000A0000-memory.dmp

Filesize
64KB

Download
memory/1548-67-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1548-68-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1548-69-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1832-80-0x00000000009A0000-0x00000000009BF000-memory.dmp

Filesize
124KB

Download
memory/1832-86-0x00000000007D0000-0x000000000085F000-memory.dmp

Filesize
572KB

Download
memory/1832-83-0x0000000001DC0000-0x00000000020C3000-memory.dmp

Filesize
3.0MB

Download
memory/1832-82-0x0000000000100000-0x000000000012D000-memory.dmp

Filesize
180KB

Download
memory/1832-81-0x00000000009A0000-0x00000000009BF000-memory.dmp

Filesize
124KB

Download
memory/1832-129-0x0000000061E00000-0x0000000061ECA000-memory.dmp

Filesize
808KB

Download
memory/1832-132-0x0000000061E00000-0x0000000061ECA000-memory.dmp

Filesize
808KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads