0fe972a442a2a81291c38a4f5a5f08ad427988e341477971f98eb475efc63643

General

Target
0fe972a442a2a81291c38a4f5a5f08ad427988e341477971f98eb475efc63643.exe
Size 896KB
Sample260702-ldp1paft2x
SHA256 0fe972a442a2a81291c38a4f5a5f08ad427988e341477971f98eb475efc63643
MD5 6adab7a4031a1272e27e690db5a862f8
SHA1 484d9b6994dd2ea9323c0db2e3e5aa330ca6d324
SHA512 861069073b5264b48abe7b685a5592fa3915a15a420d851086c794f06e3de2451572ca0e7d76b953443599530758ae98c3b9264efbc88b346f2145ef8030025a
SSDEEP 12288:aqi5Kg+u+B7GsvnMEytcrpTvrNwGMxp6aA75DJdN+lmR9WP8YmO:ni5P+uK75vMEyyrJMIJJL+O9K8YmO
TLSH
T13A159E12F6DA80F2C715253104BA773ADA31F6070B25EBD3936AEE2D6C33191EA37156
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Windows\CurrentVersion\Run\MyAutoRun = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0fe972a442a2a81291c38a4f5a5f08ad427988e341477971f98eb475efc63643.exe"	0fe972a442a2a81291c38a4f5a5f08ad427988e341477971f98eb475efc63643.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Windows\CurrentVersion\Run\MyAutoRun = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0fe972a442a2a81291c38a4f5a5f08ad427988e341477971f98eb475efc63643.exe"	0fe972a442a2a81291c38a4f5a5f08ad427988e341477971f98eb475efc63643.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0fe972a442a2a81291c38a4f5a5f08ad427988e341477971f98eb475efc63643.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0fe972a442a2a81291c38a4f5a5f08ad427988e341477971f98eb475efc63643.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Software\Microsoft\Windows\CurrentVersion\Policies\System	0fe972a442a2a81291c38a4f5a5f08ad427988e341477971f98eb475efc63643.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	0fe972a442a2a81291c38a4f5a5f08ad427988e341477971f98eb475efc63643.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	0fe972a442a2a81291c38a4f5a5f08ad427988e341477971f98eb475efc63643.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Software	0fe972a442a2a81291c38a4f5a5f08ad427988e341477971f98eb475efc63643.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft	0fe972a442a2a81291c38a4f5a5f08ad427988e341477971f98eb475efc63643.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows	0fe972a442a2a81291c38a4f5a5f08ad427988e341477971f98eb475efc63643.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion	0fe972a442a2a81291c38a4f5a5f08ad427988e341477971f98eb475efc63643.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies	0fe972a442a2a81291c38a4f5a5f08ad427988e341477971f98eb475efc63643.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	0fe972a442a2a81291c38a4f5a5f08ad427988e341477971f98eb475efc63643.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Suspicious use of SetWindowsHookEx 6 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1784	1936	0fe972a442a2a81291c38a4f5a5f08ad427988e341477971f98eb475efc63643.exe	88
PID 1784 wrote to memory of 4980	1784	net.exe	90
PID 1936 wrote to memory of 1620	1936	0fe972a442a2a81291c38a4f5a5f08ad427988e341477971f98eb475efc63643.exe	91
PID 4440 wrote to memory of 3932	4440	0fe972a442a2a81291c38a4f5a5f08ad427988e341477971f98eb475efc63643.exe	94
PID 3932 wrote to memory of 4372	3932	net.exe	96
PID 4440 wrote to memory of 5808	4440	0fe972a442a2a81291c38a4f5a5f08ad427988e341477971f98eb475efc63643.exe	97

C:\Users\Admin\AppData\Local\Temp\0fe972a442a2a81291c38a4f5a5f08ad427988e341477971f98eb475efc63643.exe
"C:\Users\Admin\AppData\Local\Temp\0fe972a442a2a81291c38a4f5a5f08ad427988e341477971f98eb475efc63643.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\net.exe
  net user Admin skynb6
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 user Admin skynb6
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4980
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1620

C:\Users\Admin\AppData\Local\Temp\0fe972a442a2a81291c38a4f5a5f08ad427988e341477971f98eb475efc63643.exe
C:\Users\Admin\AppData\Local\Temp\0fe972a442a2a81291c38a4f5a5f08ad427988e341477971f98eb475efc63643.exe
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\SysWOW64\net.exe
  net user Admin skynb6
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3932
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 user Admin skynb6
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4372
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5808