7516c84a016536e17d94740142f22e375d010a76b7610eddd12043b1676c6db4

Analysis

max time kernel
158s
max time network
181s
platform
windows10_x64
resource
win10-en-20211208
submitted
30-01-2022 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7516c84a016536e17d94740142f22e375d010a76b7610eddd12043b1676c6db4.exe
Size

1.4MB
MD5

48dee0033baf8d606b2fbb649a6e4b71
SHA1

fbd97a00132d02df575aba0b332d3febbad7aa75
SHA256

7516c84a016536e17d94740142f22e375d010a76b7610eddd12043b1676c6db4
SHA512

fafac3b39e12688a47a81d515f192b278a3a7212019f10b04992774768979000212b426d6d03a05de1905ce9dbca09b75f3a34def4c4e5265e054909dc0290eb

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

mnd.exemnd.exe

pid process

1572 mnd.exe
2964 mnd.exe

pid	process
1572	mnd.exe
2964	mnd.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2968-335-0x0000000001610000-0x000000000171E000-memory.dmp	upx
behavioral2/memory/2968-334-0x0000000001610000-0x000000000171E000-memory.dmp	upx
behavioral2/memory/2968-336-0x0000000001610000-0x000000000171E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

mnd.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	mnd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdatere = "C:\\Users\\Admin\\AppData\\Roaming\\ugt\\mnd.exe C:\\Users\\Admin\\AppData\\Roaming\\ugt\\vpt-ipi"	mnd.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

mnd.exeRegSvcs.exeRegSvcs.exe

description	pid	process	target process
PID 2964 set thread context of 1080	2964	mnd.exe	RegSvcs.exe
PID 1080 set thread context of 2968	1080	RegSvcs.exe	RegSvcs.exe
PID 2964 set thread context of 3336	2964	mnd.exe	RegSvcs.exe
PID 3336 set thread context of 560	3336	RegSvcs.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

RegSvcs.exeRegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

mnd.exeRegSvcs.exeRegSvcs.exe

pid process

1572 mnd.exe
1572 mnd.exe
2968 RegSvcs.exe
2968 RegSvcs.exe
560 RegSvcs.exe
560 RegSvcs.exe
Suspicious behavior: SetClipboardViewer 1 IoCs

Processes:

RegSvcs.exe

pid process

3336 RegSvcs.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

RegSvcs.exeRegSvcs.exeRegSvcs.exe

pid process

1080 RegSvcs.exe
2968 RegSvcs.exe
3336 RegSvcs.exe

pid	process
1572	mnd.exe
1572	mnd.exe
2968	RegSvcs.exe
2968	RegSvcs.exe
560	RegSvcs.exe
560	RegSvcs.exe

pid	process
3336	RegSvcs.exe

pid	process
1080	RegSvcs.exe
2968	RegSvcs.exe
3336	RegSvcs.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

7516c84a016536e17d94740142f22e375d010a76b7610eddd12043b1676c6db4.exemnd.exemnd.exeRegSvcs.exeRegSvcs.exe

description	pid	process	target process
PID 832 wrote to memory of 1572	832	7516c84a016536e17d94740142f22e375d010a76b7610eddd12043b1676c6db4.exe	mnd.exe
PID 832 wrote to memory of 1572	832	7516c84a016536e17d94740142f22e375d010a76b7610eddd12043b1676c6db4.exe	mnd.exe
PID 832 wrote to memory of 1572	832	7516c84a016536e17d94740142f22e375d010a76b7610eddd12043b1676c6db4.exe	mnd.exe
PID 1572 wrote to memory of 2964	1572	mnd.exe	mnd.exe
PID 1572 wrote to memory of 2964	1572	mnd.exe	mnd.exe
PID 1572 wrote to memory of 2964	1572	mnd.exe	mnd.exe
PID 2964 wrote to memory of 1080	2964	mnd.exe	RegSvcs.exe
PID 2964 wrote to memory of 1080	2964	mnd.exe	RegSvcs.exe
PID 2964 wrote to memory of 1080	2964	mnd.exe	RegSvcs.exe
PID 2964 wrote to memory of 1080	2964	mnd.exe	RegSvcs.exe
PID 2964 wrote to memory of 1080	2964	mnd.exe	RegSvcs.exe
PID 1080 wrote to memory of 2968	1080	RegSvcs.exe	RegSvcs.exe
PID 1080 wrote to memory of 2968	1080	RegSvcs.exe	RegSvcs.exe
PID 1080 wrote to memory of 2968	1080	RegSvcs.exe	RegSvcs.exe
PID 1080 wrote to memory of 2968	1080	RegSvcs.exe	RegSvcs.exe
PID 1080 wrote to memory of 2968	1080	RegSvcs.exe	RegSvcs.exe
PID 1080 wrote to memory of 2968	1080	RegSvcs.exe	RegSvcs.exe
PID 1080 wrote to memory of 2968	1080	RegSvcs.exe	RegSvcs.exe
PID 1080 wrote to memory of 2968	1080	RegSvcs.exe	RegSvcs.exe
PID 2964 wrote to memory of 3336	2964	mnd.exe	RegSvcs.exe
PID 2964 wrote to memory of 3336	2964	mnd.exe	RegSvcs.exe
PID 2964 wrote to memory of 3336	2964	mnd.exe	RegSvcs.exe
PID 2964 wrote to memory of 3336	2964	mnd.exe	RegSvcs.exe
PID 2964 wrote to memory of 3336	2964	mnd.exe	RegSvcs.exe
PID 3336 wrote to memory of 560	3336	RegSvcs.exe	RegSvcs.exe
PID 3336 wrote to memory of 560	3336	RegSvcs.exe	RegSvcs.exe
PID 3336 wrote to memory of 560	3336	RegSvcs.exe	RegSvcs.exe
PID 3336 wrote to memory of 560	3336	RegSvcs.exe	RegSvcs.exe
PID 3336 wrote to memory of 560	3336	RegSvcs.exe	RegSvcs.exe
PID 3336 wrote to memory of 560	3336	RegSvcs.exe	RegSvcs.exe
PID 3336 wrote to memory of 560	3336	RegSvcs.exe	RegSvcs.exe
PID 3336 wrote to memory of 560	3336	RegSvcs.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\7516c84a016536e17d94740142f22e375d010a76b7610eddd12043b1676c6db4.exe
"C:\Users\Admin\AppData\Local\Temp\7516c84a016536e17d94740142f22e375d010a76b7610eddd12043b1676c6db4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:832

C:\Users\Admin\AppData\Roaming\ugt\mnd.exe
"C:\Users\Admin\AppData\Roaming\ugt\mnd.exe" vpt-ipi
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1572

C:\Users\Admin\AppData\Roaming\ugt\mnd.exe
C:\Users\Admin\AppData\Roaming\ugt\mnd.exe C:\Users\Admin\AppData\Roaming\ugt\ONQHY
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2964

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
4⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
5⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2968

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: SetClipboardViewer
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3336

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
5⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:560

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\zUB8dknwC\zUB8dknwC.dat
MD5
93e00066d099c0485cfffa1359246d26

SHA1
bc69a773f37b2f2071e25f755a66d47b871e5d98

SHA256
3b271649a94ad5be4ef46ecbb6a4e7363e8498b7e69b751737bf30df2e0d1dde

SHA512
d3dfe508cacae7d36f13908134b5b438b87429fcf93ccb060bcfa346c04633a99e9ca497297418c969537be1da2405171982794055dd0f52e59a82720d3b3d02

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\zUB8dknwC\zUB8dknwC.nfo
MD5
5da5f797e19da65017db699019c7c4e6

SHA1
61e6ac756c58e361325a9d1ecc306cfd70a7e477

SHA256
f7dbb6b03e18c8ea542f56b689540561a56438083ba93a0dfaf13a5217ce432c

SHA512
570f47fe0028ba1b53b764beb7716a1596d7a7085c5b232ae3ec4c0bfa535ca0c9e4372b5254aeefd11ed9b73dc0f8919835e3c4ade9b0662ed942171cda930b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\zUB8dknwC\zUB8dknwC.svr
MD5
74b95118128f276328bd18db61c141f0

SHA1
b83ec9f9c9db285cc8a39ba196a487eaa9a831d7

SHA256
95e4f8cf64c5311a338587db944bf1c18bcbe705226b7aa81a46fb96bff0a7e5

SHA512
97b8b6f0b0df20445fa7db9d7656d8b2f50c542a1c90d9df4bceabad73be39643b736a15d8b0ffaac9809ee0d9c6a4fcdc1f57579d57ceb79e0529a09bedcc28

Download Submit
C:\Users\Admin\AppData\Roaming\ugt\ONQHY
MD5
5db96f1aa7be4a9c99b52c7a3a0581ca

SHA1
f6d2c9cb4b45414051f9b4678eef015f6baa5366

SHA256
95158e531eebb60f2fc6798f2112625cc016bf119c9282e8757424feded27110

SHA512
b014efdef22b773b8403fed2fbab681a2135d104e012f2a43234328397b356341506f0c056af07b433bf0b7889092f0d21b2505fc92663b7cf4340c0207a3a8e

Download Submit
C:\Users\Admin\AppData\Roaming\ugt\lmb.bmp
MD5
cef25a2da0595496bf5fe8477f928ee0

SHA1
205246ecfbbe774d2af134d992c77aa410f28fc1

SHA256
3a8f1a2b200c6d7340dc8fb0b9710cee28e1ddd097fe0c0b1168cdc93228423e

SHA512
3cb8d3665f358f152b48ef7179649cac257c2e00db8a26b02c26d85992f3932b3d4d6214150d0be9fd58a953b693faaf44224d036a48a348df1ade82e76f5c46

Download Submit
C:\Users\Admin\AppData\Roaming\ugt\mnd.exe
MD5
71d8f6d5dc35517275bc38ebcc815f9f

SHA1
cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

SHA256
fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

SHA512
4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

Download Submit
C:\Users\Admin\AppData\Roaming\ugt\mnd.exe
MD5
71d8f6d5dc35517275bc38ebcc815f9f

SHA1
cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

SHA256
fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

SHA512
4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

Download Submit
C:\Users\Admin\AppData\Roaming\ugt\mnd.exe
MD5
71d8f6d5dc35517275bc38ebcc815f9f

SHA1
cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

SHA256
fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

SHA512
4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

Download Submit
C:\Users\Admin\AppData\Roaming\ugt\vpt-ipi
MD5
ececabf7b2dedf9d16c3648451d4d309

SHA1
8300e0d3d60ebe3d84bd8bc6171e674d11bc38f5

SHA256
690b21fcdb4be63a6a1a6448fbd47cd42edfb7b9ce44510c7cb28f61a3138483

SHA512
76d4855ce2125d8d74c9234eb5e93cea94fc4266ed0089860ddcc921fc570ac3cc75ec3565902c0b7cb9693cb125fc90bc5e22775767170789eab34c7dc89c9a

Download Submit
memory/560-350-0x0000000001611000-0x000000000171E000-memory.dmp

Filesize
1.1MB

Download
memory/560-351-0x00000000012E0000-0x00000000012E1000-memory.dmp

Filesize
4KB

Download
memory/1080-333-0x0000000001150000-0x0000000008F8F000-memory.dmp

Filesize
126.2MB

Download
memory/1080-332-0x0000000001150000-0x0000000008F8F000-memory.dmp

Filesize
126.2MB

Download
memory/2968-336-0x0000000001610000-0x000000000171E000-memory.dmp

Filesize
1.1MB

Download
memory/2968-341-0x00000000016C4000-0x000000000171C000-memory.dmp

Filesize
352KB

Download
memory/2968-342-0x0000000003300000-0x0000000003301000-memory.dmp

Filesize
4KB

Download
memory/2968-340-0x0000000001611000-0x000000000171E000-memory.dmp

Filesize
1.1MB

Download
memory/2968-334-0x0000000001610000-0x000000000171E000-memory.dmp

Filesize
1.1MB

Download
memory/2968-335-0x0000000001610000-0x000000000171E000-memory.dmp

Filesize
1.1MB

Download
memory/3336-343-0x0000000001300000-0x0000000008EB3000-memory.dmp

Filesize
123.7MB

Download
memory/3336-347-0x0000000001300000-0x0000000008EB3000-memory.dmp

Filesize
123.7MB

Download