5bc55a28df511497fef465f3127424ec2ef9dc6f0ba465e3491156102a6b01a4

Resubmissions

23-09-2021 13:58

210923-raaz9aefc4 8

22-08-2021 12:57

210822-9mjev45vne 10

Analysis

max time kernel
143s
max time network
138s
platform
windows7_x64
resource
win7-en-20210920
submitted
23-09-2021 13:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dvdfab_player_6115.exe
Size

102.3MB
MD5

12880e15e937216cb83b7a2cb328909e
SHA1

56fec932ebad7b73b1629bd510416dc33a186ea3
SHA256

fcbf364dfa1211e904b23c5fbd6bb67159d4e4f56777f0445977e38b6d49777f
SHA512

2d63cc5db2eb219c4349e2fdf2436b334779b50b6184c8e54ed65fba0fb803c74dfe0f19f9e404b53511df0d249b8adbd3646dd8f7404b5d9fbb67ab5c42d87d

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/992-58-0x0000000000400000-0x00000000005F7000-memory.dmp	upx
behavioral1/memory/992-61-0x0000000000400000-0x00000000005F7000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

dvdfab_player_6115.exe

description pid process target process

PID 968 set thread context of 992 968 dvdfab_player_6115.exe AppLaunch.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 968 set thread context of 992	968	dvdfab_player_6115.exe	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

dvdfab_player_6115.exeAppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	968	dvdfab_player_6115.exe
Token: SeDebugPrivilege	992	AppLaunch.exe
Token: SeShutdownPrivilege	992	AppLaunch.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

dvdfab_player_6115.exe

description	pid	process	target process
PID 968 wrote to memory of 516	968	dvdfab_player_6115.exe	cmd.exe
PID 968 wrote to memory of 516	968	dvdfab_player_6115.exe	cmd.exe
PID 968 wrote to memory of 516	968	dvdfab_player_6115.exe	cmd.exe
PID 968 wrote to memory of 516	968	dvdfab_player_6115.exe	cmd.exe
PID 968 wrote to memory of 992	968	dvdfab_player_6115.exe	AppLaunch.exe
PID 968 wrote to memory of 992	968	dvdfab_player_6115.exe	AppLaunch.exe
PID 968 wrote to memory of 992	968	dvdfab_player_6115.exe	AppLaunch.exe
PID 968 wrote to memory of 992	968	dvdfab_player_6115.exe	AppLaunch.exe
PID 968 wrote to memory of 992	968	dvdfab_player_6115.exe	AppLaunch.exe
PID 968 wrote to memory of 992	968	dvdfab_player_6115.exe	AppLaunch.exe
PID 968 wrote to memory of 992	968	dvdfab_player_6115.exe	AppLaunch.exe
PID 968 wrote to memory of 992	968	dvdfab_player_6115.exe	AppLaunch.exe
PID 968 wrote to memory of 992	968	dvdfab_player_6115.exe	AppLaunch.exe
PID 968 wrote to memory of 992	968	dvdfab_player_6115.exe	AppLaunch.exe
PID 968 wrote to memory of 992	968	dvdfab_player_6115.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\dvdfab_player_6115.exe
"C:\Users\Admin\AppData\Local\Temp\dvdfab_player_6115.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c
2⤵
PID:516

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:992

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/516-57-0x0000000000000000-mapping.dmp

Download
memory/968-54-0x0000000000040000-0x0000000000041000-memory.dmp

Filesize
4KB

Download
memory/968-56-0x000000000B150000-0x000000000B151000-memory.dmp

Filesize
4KB

Download
memory/992-58-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/992-59-0x00000000005F5A70-mapping.dmp

Download
memory/992-60-0x0000000076B61000-0x0000000076B63000-memory.dmp

Filesize
8KB

Download
memory/992-61-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/992-62-0x0000000002EE0000-0x0000000003EE0000-memory.dmp

Filesize
16.0MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads