ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82

General

Target

ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
Size

1.5MB
MD5

ae94e46875ce7cd53c9af3b09a694d51
SHA1

94a08e15b970b755485f36a2b834cb3f7162cfc3
SHA256

ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82
SHA512

d5e0ac3d5fd6ba0878047f4b4d7669a858464f446299b64b9366802c7e4a2f129e3d39aae7c9f43644f4266dc561847c3cc808b136ef4814d0cb6866c271d0d7
SSDEEP

3072:iJUg3tGXRvjxCb5NgXDY7uSK4aqTBGgmQmXJQYKYYFkm/:X7lKgzeYqTDmQmCYTYn/

Score

6^/10

ransomware

Malware Config

Signatures

Enumerates connected drives 3 TTPs 10 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
File opened (read-only)	\??\E:	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
File opened (read-only)	\??\G:	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
File opened (read-only)	\??\I:	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
File opened (read-only)	\??\L:	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
File opened (read-only)	\??\N:	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
File opened (read-only)	\??\O:	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
File opened (read-only)	\??\H:	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
File opened (read-only)	\??\J:	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
File opened (read-only)	\??\K:	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\Wallpaper = "C:\\windows\\WallPapers.jpg"	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
File opened for modification	C:\Program Files\7-Zip\RCX5C06.tmp	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
File opened for modification	C:\Program Files\7-Zip\RCX5E68.tmp	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
File opened for modification	C:\Program Files\7-Zip\RCX5E88.tmp	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
File opened for modification	C:\Program Files\7-Zip\RCX5F06.tmp	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX660F.tmp	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
File created	C:\Program Files\readme.1xt	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
File created	C:\Program Files\7-Zip\7z.exe	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.cab	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
File created	C:\Program Files\7-Zip\7zFM.cab	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
File created	C:\Program Files\7-Zip\7zFM.exe	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
File opened for modification	C:\Program Files\7-Zip\RCX5F17.tmp	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
File opened for modification	C:\Program Files\7-Zip\RCX608F.tmp	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX65DF.tmp	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
File created	C:\Program Files\7-Zip\7z.cab	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
File opened for modification	C:\Program Files\7-Zip\7z.cab	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\windows\readme.1xt	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
File created	C:\windows\WallPapers.jpg	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2136	5108	WerFault.exe	93

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Desktop\General	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\WallpaperSource = "C:\\windows\\WallPapers.jpg"	ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe

C:\Users\Admin\AppData\Local\Temp\ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe
"C:\Users\Admin\AppData\Local\Temp\ea458dcf671ace624206b9f2ca40f61d41444498f2ac17813396289f342eee82.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
PID:5108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 720
  2⤵
  - Program crash
  PID:2136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3976 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:2840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5108 -ip 5108
1⤵
PID:4756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.cab

Filesize
544KB

MD5
9a1dd1d96481d61934dcc2d568971d06

SHA1
f136ef9bf8bd2fc753292fb5b7cf173a22675fb3

SHA256
8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525

SHA512
7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
1.5MB

MD5
a14655bf02db15d202a15a5a5d3f1f90

SHA1
e1a80011acae28a324aef59388876507b71d6f04

SHA256
9548b0b9510142c67543904cbf73ee3376d00a8bcf51380e4979825e0051f56b

SHA512
d8d2a2e09dffeb88c8b99ad0693bc93b6571dbcbe63eff64b6c0dfd116cf5364985750544a38e4035cee6d1471622e41d4c5dae5a244d697ee53d6cc01f61f32

Download Submit
C:\Program Files\7-Zip\7zFM.cab

Filesize
930KB

MD5
30ac0b832d75598fb3ec37b6f2a8c86a

SHA1
6f47dbfd6ff36df7ba581a4cef024da527dc3046

SHA256
1ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74

SHA512
505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX65DF.tmp

Filesize
264KB

MD5
30109f822d20983bdbcdd9fb0a31aefe

SHA1
dd761f66ccb1248badfc2cf5402c1923e934842f

SHA256
7b4aca37811c76d91c402365bb1287f9bd341e331bd934d09522fbb61ae59fb9

SHA512
205a021844fb9354821907a51d0f85f54220d77123290477c0624ca690a3ac5ac6bc6240b2c0949babf981a465ad4cba584b984e59f65ddb45741e145a150329

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab

Filesize
2.1MB

MD5
b8d69fa2755c3ab1f12f8866a8e2a4f7

SHA1
8e3cdfb20e158c2906323ba0094a18c7dd2aaf2d

SHA256
7e0976036431640ae1d9f1c0b52bcea5dd37ef86cd3f5304dc8a96459d9483cd

SHA512
5acac46068b331216978500f67a7fa5257bc5b05133fab6d88280b670ae4885ef2d5d1f531169b66bf1952e082f56b1ad2bc3901479b740f96c53ea405adda18

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads