21bc6e657606c08dca9703d2149640fa9738c460c8d71a65b8913b5c7a7ae0f4

General

Target
545e336e9b3957da924cdbf9ccc49037.exe
Size 536KB
Sample210217-8r6t5yh2a2
SHA256 21bc6e657606c08dca9703d2149640fa9738c460c8d71a65b8913b5c7a7ae0f4
MD5 545e336e9b3957da924cdbf9ccc49037
SHA1 1021e7a98f945c5b910646ceec49e213f3bd1104
SHA512 0cb2c0c79c948bcf886b4d231721e030cb3c95e1be4ababbf7d5efa091baf2e75531230b148d789972d3a9c1be14e6d3d8815e600fd3f8aed79a34535e3f2aff
MD5 SHA1 SHA512

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\YYtJku = "C:\\Users\\Admin\\AppData\\Roaming\\YYtJku\\YYtJku.exe"	545e336e9b3957da924cdbf9ccc49037.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 776 set thread context of 1568	776	545e336e9b3957da924cdbf9ccc49037.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1488	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1568	545e336e9b3957da924cdbf9ccc49037.exe
1568	545e336e9b3957da924cdbf9ccc49037.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1568	545e336e9b3957da924cdbf9ccc49037.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1568	545e336e9b3957da924cdbf9ccc49037.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 1488	776	545e336e9b3957da924cdbf9ccc49037.exe	29
PID 776 wrote to memory of 1488	776	545e336e9b3957da924cdbf9ccc49037.exe	29
PID 776 wrote to memory of 1488	776	545e336e9b3957da924cdbf9ccc49037.exe	29
PID 776 wrote to memory of 1488	776	545e336e9b3957da924cdbf9ccc49037.exe	29
PID 776 wrote to memory of 1568	776	545e336e9b3957da924cdbf9ccc49037.exe	31
PID 776 wrote to memory of 1568	776	545e336e9b3957da924cdbf9ccc49037.exe	31
PID 776 wrote to memory of 1568	776	545e336e9b3957da924cdbf9ccc49037.exe	31
PID 776 wrote to memory of 1568	776	545e336e9b3957da924cdbf9ccc49037.exe	31
PID 776 wrote to memory of 1568	776	545e336e9b3957da924cdbf9ccc49037.exe	31
PID 776 wrote to memory of 1568	776	545e336e9b3957da924cdbf9ccc49037.exe	31
PID 776 wrote to memory of 1568	776	545e336e9b3957da924cdbf9ccc49037.exe	31
PID 776 wrote to memory of 1568	776	545e336e9b3957da924cdbf9ccc49037.exe	31
PID 776 wrote to memory of 1568	776	545e336e9b3957da924cdbf9ccc49037.exe	31

C:\Users\Admin\AppData\Local\Temp\545e336e9b3957da924cdbf9ccc49037.exe
"C:\Users\Admin\AppData\Local\Temp\545e336e9b3957da924cdbf9ccc49037.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:776
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CvcHHOJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp628.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1488
- C:\Users\Admin\AppData\Local\Temp\545e336e9b3957da924cdbf9ccc49037.exe
  "C:\Users\Admin\AppData\Local\Temp\545e336e9b3957da924cdbf9ccc49037.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:1568