004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7

General

Target
004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe
Size 400KB
Sample261002-gry4astsf1
SHA256 004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7
MD5 80955df27c81bf5a4b481a07b9567c06
SHA1 0f9cf541561aa6181d379d6e87faec8f77a0ab7b
SHA512 4c6961806dc01166b8e47a81246dc35288ca06740f95a356525e3792a238ccdcd452e14c8ae334738d4ef3e56c19d887360a05416f423c97c5dc8436b91fcf48
SSDEEP 6144:h3bFte0kbp15x0M7iV8fEAJZsx3UiokNJwL:JFtSpzx5iV88AJZsx3UhL
TLSH
T10A947D06F686F132C11316F56E2BD36A8436B9625B340EC7FBC09D2D9E652D19B3630E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Logman = "C:\\Windows\\logman.exe"	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DllHost3g = "C:\\Windows\\System32\\drivers\\dllhst3g.exe"	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\dllhst3g.exe	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe
File opened for modification	C:\Windows\SysWOW64\drivers\RCX75AA.tmp	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe

Executes dropped EXE 20 IoCs

pid	Process
4104	logman.exe
4264	lsm.exe
1880	dllhst3g.exe
2492	sessmgr.exe
3524	esentutl.exe
4440	mstinit.exe
3496	csrss.exe
5052	esentutl.exe
4280	logman.exe
4916	lsm.exe
3984	esentutl.exe
3988	logman.exe
3064	sessmgr.exe
2832	lsm.exe
224	dllhst3g.exe
3300	sessmgr.exe
4736	esentutl.exe
2172	mstinit.exe
64	csrss.exe
1608	esentutl.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lsm service = "C:\\Windows\\lsm.exe"	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Sessmgr = "C:\\Users\\Admin\\Local Settings\\Application Data\\Microsoft\\sessmgr.exe"	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\PROGRA~3\MICROS~1\mstinit.exe	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe
File opened for modification	C:\PROGRA~3\MICROS~1\RCX76F5.tmp	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe
File created	C:\PROGRA~3\esentutl.exe	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe
File opened for modification	C:\PROGRA~3\RCX7687.tmp	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\logman.exe	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe
File opened for modification	C:\Windows\logman.exe	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe
File opened for modification	C:\Windows\RCX74FC.tmp	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe
File created	C:\Windows\lsm.exe	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe
File opened for modification	C:\Windows\RCX754B.tmp	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe
File created	C:\Windows\System\esentutl.exe	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe
File opened for modification	C:\Windows\System\RCX7774.tmp	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	lsm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	lsm.exe

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhst3g.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhst3g.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sessmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	esentutl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	esentutl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sessmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mstinit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	esentutl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mstinit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	esentutl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	logman.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	logman.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sessmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	esentutl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	logman.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Csrss = "C:\\Users\\Admin\\Local Settings\\Application Data\\Microsoft\\csrss.exe"	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe
Key created	\REGISTRY\USER\.DEFAULT	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\EseNtUtl = "C:\\Windows\\System\\esentutl.exe"	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4576	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 4104	1604	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe	87
PID 1604 wrote to memory of 4264	1604	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe	88
PID 1604 wrote to memory of 1880	1604	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe	89
PID 1604 wrote to memory of 2492	1604	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe	90
PID 1604 wrote to memory of 3524	1604	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe	91
PID 1604 wrote to memory of 4440	1604	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe	92
PID 1604 wrote to memory of 3496	1604	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe	93
PID 1604 wrote to memory of 5052	1604	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe	95
PID 1604 wrote to memory of 4280	1604	004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe	96
PID 4916 wrote to memory of 3988	4916	lsm.exe	103
PID 4916 wrote to memory of 2832	4916	lsm.exe	105
PID 4916 wrote to memory of 224	4916	lsm.exe	106
PID 4916 wrote to memory of 3300	4916	lsm.exe	107
PID 4916 wrote to memory of 4736	4916	lsm.exe	108
PID 4916 wrote to memory of 2172	4916	lsm.exe	110
PID 4916 wrote to memory of 64	4916	lsm.exe	112
PID 4916 wrote to memory of 1608	4916	lsm.exe	113

C:\Users\Admin\AppData\Local\Temp\004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe
"C:\Users\Admin\AppData\Local\Temp\004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7.exe"
1⤵
- Adds policy Run key to start application
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\logman.exe
  C:\Windows\logman.exe /c 90
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4104
- C:\Windows\lsm.exe
  C:\Windows\lsm.exe /c 91
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4264
- C:\Windows\SysWOW64\drivers\dllhst3g.exe
  C:\Windows\System32\drivers\dllhst3g.exe /c 20
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1880
- C:\Users\Admin\Local Settings\Application Data\Microsoft\sessmgr.exe
  "C:\Users\Admin\Local Settings\Application Data\Microsoft\sessmgr.exe" /c 90
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2492
- C:\PROGRA~3\esentutl.exe
  C:\PROGRA~3\esentutl.exe /c 97
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3524
- C:\PROGRA~3\MICROS~1\mstinit.exe
  C:\PROGRA~3\MICROS~1\mstinit.exe /c 90
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4440
- C:\Users\Admin\Local Settings\Application Data\Microsoft\csrss.exe
  "C:\Users\Admin\Local Settings\Application Data\Microsoft\csrss.exe" /c 77
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3496
- C:\Windows\System\esentutl.exe
  C:\Windows\System\esentutl.exe /c 48
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5052
- C:\Windows\logman.exe
  C:\Windows\logman.exe /c 70
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4280

C:\Windows\lsm.exe
C:\Windows\lsm.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\logman.exe
  C:\Windows\logman.exe /c 2
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3988
- C:\Windows\lsm.exe
  C:\Windows\lsm.exe /c 51
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2832
- C:\Windows\SysWOW64\drivers\dllhst3g.exe
  C:\Windows\System32\drivers\dllhst3g.exe /c 89
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:224
- C:\Users\Admin\Local Settings\Application Data\Microsoft\sessmgr.exe
  "C:\Users\Admin\Local Settings\Application Data\Microsoft\sessmgr.exe" /c 64
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3300
- C:\PROGRA~3\esentutl.exe
  C:\PROGRA~3\esentutl.exe /c 80
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4736
- C:\PROGRA~3\MICROS~1\mstinit.exe
  C:\PROGRA~3\MICROS~1\mstinit.exe /c 19
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2172
- C:\Users\Admin\Local Settings\Application Data\Microsoft\csrss.exe
  "C:\Users\Admin\Local Settings\Application Data\Microsoft\csrss.exe" /c 23
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:64
- C:\Windows\System\esentutl.exe
  C:\Windows\System\esentutl.exe /c 28
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1608

C:\Windows\System\esentutl.exe
C:\Windows\System\esentutl.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3984

C:\Users\Admin\Local Settings\Application Data\Microsoft\sessmgr.exe
"C:\Users\Admin\Local Settings\Application Data\Microsoft\sessmgr.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3064

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\hello.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Twain002.Mtx

Path C:\Users\Admin\AppData\Local\Temp\Twain002.Mtx
Size 10B
SHA256 734c48a67bc2e9217eff55d1322b901a20ec4437575c5dd6c6754b98ba33471d
MD5 26a7069faf185aa23f3c19bcd35f1369
SHA1 150f34e63857f952e1228eec972fb6d86cd273b8
SHA512 f9b6bc7f19bfec9d5678340322f9bffeab518ed9c73b39c8526a086d0a5635340f690a123d69b79af4f45cafc53548d46736a5d4aad63082d3976b4b3d1567ee
MD5 SHA1 SHA512

Submit Download

logman.exe

Path C:\Windows\logman.exe
Size 400KB
SHA256 004fdf6f6ebacf350f2367114ab8aa1d54e7a3860ec014c7d2717fdd6f9035e7
MD5 80955df27c81bf5a4b481a07b9567c06
SHA1 0f9cf541561aa6181d379d6e87faec8f77a0ab7b
SHA512 4c6961806dc01166b8e47a81246dc35288ca06740f95a356525e3792a238ccdcd452e14c8ae334738d4ef3e56c19d887360a05416f423c97c5dc8436b91fcf48
SSDEEP 6144:h3bFte0kbp15x0M7iV8fEAJZsx3UiokNJwL:JFtSpzx5iV88AJZsx3UhL
TLSH
T10A947D06F686F132C11316F56E2BD36A8436B9625B340EC7FBC09D2D9E652D19B3630E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads