24e6a700c2676fa3c1979958e16c0fa8dbd9fb818dba822cdf7ce001c1a68043

General

Target

429ac1a806b4fcdc9bf44ea6987f94f6.exe
Size

123KB
MD5

429ac1a806b4fcdc9bf44ea6987f94f6
SHA1

8e4bb6295d40c6f19aab7c47cca3d945747d41e4
SHA256

24e6a700c2676fa3c1979958e16c0fa8dbd9fb818dba822cdf7ce001c1a68043
SHA512

50dbab8769fc80ec291d338390dc3d6ea080ebd969a7cac47d23afcce4f9183b6ffbc0d5ad4a35191ea6300c60d501515f574feee47741c70bd09acce72685b4
SSDEEP

3072:Lf3nTY/Afey9FpatoPnprvFFE3sHX2qawogX48:rT68ey9utonprOe2q

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Classes = "C:\\Users\\Admin\\AppData\\Roaming\\7CE86F.exe"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

429ac1a806b4fcdc9bf44ea6987f94f6.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	429ac1a806b4fcdc9bf44ea6987f94f6.exe

Executes dropped EXE 2 IoCs

Processes:

UoaUJ.execvtres.exe

pid process

2984 UoaUJ.exe
3892 cvtres.exe

pid	process
2984	UoaUJ.exe
3892	cvtres.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

429ac1a806b4fcdc9bf44ea6987f94f6.exe

description	ioc	process
File created	C:\Windows\assembly\Desktop.ini	429ac1a806b4fcdc9bf44ea6987f94f6.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	429ac1a806b4fcdc9bf44ea6987f94f6.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

cvtres.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	cvtres.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	cvtres.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

UoaUJ.exe

description pid process target process

PID 2984 set thread context of 3892 2984 UoaUJ.exe cvtres.exe

description	pid	process	target process
PID 2984 set thread context of 3892	2984	UoaUJ.exe	cvtres.exe

Drops file in Windows directory 3 IoCs

Processes:

429ac1a806b4fcdc9bf44ea6987f94f6.exe

description	ioc	process
File opened for modification	C:\Windows\assembly	429ac1a806b4fcdc9bf44ea6987f94f6.exe
File created	C:\Windows\assembly\Desktop.ini	429ac1a806b4fcdc9bf44ea6987f94f6.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	429ac1a806b4fcdc9bf44ea6987f94f6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

UoaUJ.exe

pid process

2984 UoaUJ.exe
2984 UoaUJ.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

cvtres.exe

pid process

3892 cvtres.exe
3892 cvtres.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

UoaUJ.exe

description pid process

Token: SeDebugPrivilege 2984 UoaUJ.exe

pid	process
2984	UoaUJ.exe
2984	UoaUJ.exe

pid	process
3892	cvtres.exe
3892	cvtres.exe

description	pid	process
Token: SeDebugPrivilege	2984	UoaUJ.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

429ac1a806b4fcdc9bf44ea6987f94f6.exeUoaUJ.execvtres.exe

description	pid	process	target process
PID 1676 wrote to memory of 2984	1676	429ac1a806b4fcdc9bf44ea6987f94f6.exe	UoaUJ.exe
PID 1676 wrote to memory of 2984	1676	429ac1a806b4fcdc9bf44ea6987f94f6.exe	UoaUJ.exe
PID 1676 wrote to memory of 2984	1676	429ac1a806b4fcdc9bf44ea6987f94f6.exe	UoaUJ.exe
PID 2984 wrote to memory of 3892	2984	UoaUJ.exe	cvtres.exe
PID 2984 wrote to memory of 3892	2984	UoaUJ.exe	cvtres.exe
PID 2984 wrote to memory of 3892	2984	UoaUJ.exe	cvtres.exe
PID 2984 wrote to memory of 3892	2984	UoaUJ.exe	cvtres.exe
PID 2984 wrote to memory of 3892	2984	UoaUJ.exe	cvtres.exe
PID 2984 wrote to memory of 3892	2984	UoaUJ.exe	cvtres.exe
PID 3892 wrote to memory of 3916	3892	cvtres.exe	svchost.exe
PID 3892 wrote to memory of 3916	3892	cvtres.exe	svchost.exe
PID 3892 wrote to memory of 3916	3892	cvtres.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\429ac1a806b4fcdc9bf44ea6987f94f6.exe
"C:\Users\Admin\AppData\Local\Temp\429ac1a806b4fcdc9bf44ea6987f94f6.exe"
1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1676

C:\Users\Admin\AppData\Local\Temp\UoaUJ.exe
"C:\Users\Admin\AppData\Local\Temp\UoaUJ.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984

C:\Users\Admin\AppData\Local\Temp\cvtres.exe
C:\Users\Admin\AppData\Local\Temp\\cvtres.exe
3⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3892

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
- Adds policy Run key to start application
PID:3916

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\UoaUJ.exe
Filesize
77KB

MD5
2b0653fd5eca2b3b2c62a11beb3529f1

SHA1
97ded9593b80038976ef9f4f5360ec173476508d

SHA256
35b8cea3645e9478855787160752e5feb62156d5780213db82fe96a17a7534e5

SHA512
cdba35b21c95eaacefe770ee7537a07d4893e39a34ee594f367363d774eed1c9b2ddd834459934d81f93c763eea57ec9df084ea2bfa978c17c5b5e2ab42bb5e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\cvtres.exe
Filesize
34KB

MD5
e118330b4629b12368d91b9df6488be0

SHA1
ce90218c7e3b90df2a3409ec253048bb6472c2fd

SHA256
3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9

SHA512
ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0

Download Submit
memory/1676-28-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/1676-2-0x00000000011C0000-0x00000000011D0000-memory.dmp

Filesize
64KB

Download
memory/1676-1-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/1676-3-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/1676-6-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/1676-7-0x00000000011C0000-0x00000000011D0000-memory.dmp

Filesize
64KB

Download
memory/1676-0-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/2984-19-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/2984-20-0x00000000017B0000-0x00000000017C0000-memory.dmp

Filesize
64KB

Download
memory/2984-30-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/3892-24-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/3892-27-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/3892-32-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/3916-34-0x0000000000C10000-0x0000000000C1E000-memory.dmp

Filesize
56KB

Download
memory/3916-36-0x0000000000C10000-0x0000000000C1E000-memory.dmp

Filesize
56KB

Download
memory/3916-37-0x00000000006C0000-0x00000000006C4000-memory.dmp

Filesize
16KB

Download
memory/3916-38-0x0000000000CE0000-0x0000000000CEC000-memory.dmp

Filesize
48KB

Download
memory/3916-42-0x0000000000CE0000-0x0000000000CEC000-memory.dmp

Filesize
48KB

Download
memory/3916-43-0x0000000000CE0000-0x0000000000CEC000-memory.dmp

Filesize
48KB

Download
memory/3916-46-0x0000000000CE0000-0x0000000000CEC000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads