24d8b33ffceaa0cee17a6258d39be1317672fc481c889822cf38963e3eb488c2

General

Target

decryp.exe
Size

18KB
MD5

0bddede8897d9d810f34d4eab1f6f07a
SHA1

b0b74c8a73699f93915154826ba8cfebe92c1dd4
SHA256

24d8b33ffceaa0cee17a6258d39be1317672fc481c889822cf38963e3eb488c2
SHA512

ae2e6cd9495b54c6fc9c4c27ece37bf0719bf42bd9c5bba4a29782f50d127d6a32461a405d9014b311e9de51d0ffc7c6001f9dbcdbbde94a92a2c51e661fe1fa
SSDEEP

384:3G1LKciD3h+fRSsBS9UpM8WefjHYc0wu:3G1LK1/sBS978/fTYc0wu

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 5 IoCs

evasion

Windows Service

T1543.003

pid	Process
3276	netsh.exe
1440	netsh.exe
3692	netsh.exe
1860	netsh.exe
3324	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	decryp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2364	reg.exe
1896	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3120	powershell.exe
3120	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3120	powershell.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 1992	3404	decryp.exe	84
PID 3404 wrote to memory of 1992	3404	decryp.exe	84
PID 1992 wrote to memory of 3692	1992	cmd.exe	86
PID 1992 wrote to memory of 3692	1992	cmd.exe	86
PID 1992 wrote to memory of 1860	1992	cmd.exe	87
PID 1992 wrote to memory of 1860	1992	cmd.exe	87
PID 1992 wrote to memory of 3324	1992	cmd.exe	89
PID 1992 wrote to memory of 3324	1992	cmd.exe	89
PID 1992 wrote to memory of 3276	1992	cmd.exe	90
PID 1992 wrote to memory of 3276	1992	cmd.exe	90
PID 1992 wrote to memory of 1440	1992	cmd.exe	91
PID 1992 wrote to memory of 1440	1992	cmd.exe	91
PID 1992 wrote to memory of 4560	1992	cmd.exe	92
PID 1992 wrote to memory of 4560	1992	cmd.exe	92
PID 1992 wrote to memory of 2364	1992	cmd.exe	93
PID 1992 wrote to memory of 2364	1992	cmd.exe	93
PID 1992 wrote to memory of 2932	1992	cmd.exe	94
PID 1992 wrote to memory of 2932	1992	cmd.exe	94
PID 1992 wrote to memory of 1896	1992	cmd.exe	95
PID 1992 wrote to memory of 1896	1992	cmd.exe	95
PID 1992 wrote to memory of 3120	1992	cmd.exe	96
PID 1992 wrote to memory of 3120	1992	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\decryp.exe
"C:\Users\Admin\AppData\Local\Temp\decryp.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh advfirewall set allprofiles state on & netsh advfirewall set currentprofile state on & netsh advfirewall set domainprofile state on & netsh advfirewall set privateprofile state on & netsh advfirewall set publicprofile state on & REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /f & REG DELETE HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ /v DisableTaskMgr /f & REG DELETE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /f & REG DELETE HKCU\Software\Microsoft\Windows\System\ /v DisableCMD /f & powershell -Command Remove-MpPreference -ExclusionExtension .exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state on
    3⤵
    - Modifies Windows Firewall
    PID:3692
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set currentprofile state on
    3⤵
    - Modifies Windows Firewall
    PID:1860
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set domainprofile state on
    3⤵
    - Modifies Windows Firewall
    PID:3324
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set privateprofile state on
    3⤵
    - Modifies Windows Firewall
    PID:3276
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set publicprofile state on
    3⤵
    - Modifies Windows Firewall
    PID:1440
- - C:\Windows\system32\reg.exe
    REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /f
    3⤵
    PID:4560
- - C:\Windows\system32\reg.exe
    REG DELETE HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ /v DisableTaskMgr /f
    3⤵
    - Modifies registry key
    PID:2364
- - C:\Windows\system32\reg.exe
    REG DELETE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /f
    3⤵
    PID:2932
- - C:\Windows\system32\reg.exe
    REG DELETE HKCU\Software\Microsoft\Windows\System\ /v DisableCMD /f
    3⤵
    - Modifies registry key
    PID:1896
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Remove-MpPreference -ExclusionExtension .exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_you3cyda.5p3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3120-4-0x00007FFCB69A0000-0x00007FFCB7461000-memory.dmp

Filesize
10.8MB

Download
memory/3120-5-0x0000028BD6F70000-0x0000028BD6F80000-memory.dmp

Filesize
64KB

Download
memory/3120-7-0x0000028BD6F70000-0x0000028BD6F80000-memory.dmp

Filesize
64KB

Download
memory/3120-6-0x0000028BBEBF0000-0x0000028BBEC12000-memory.dmp

Filesize
136KB

Download
memory/3120-17-0x0000028BD6F70000-0x0000028BD6F80000-memory.dmp

Filesize
64KB

Download
memory/3120-20-0x00007FFCB69A0000-0x00007FFCB7461000-memory.dmp

Filesize
10.8MB

Download
memory/3404-0-0x00000000007C0000-0x00000000007CA000-memory.dmp

Filesize
40KB

Download
memory/3404-1-0x00007FFCB7620000-0x00007FFCB80E1000-memory.dmp

Filesize
10.8MB

Download
memory/3404-3-0x00007FFCB7620000-0x00007FFCB80E1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads