0a63a636528473bd9ae6170a601ebf535de5eb0d4700dd653345bad8833c4bc9

General

Target

0a63a636528473bd9ae6170a601ebf535de5eb0d4700dd653345bad8833c4bc9.exe
Size

1.3MB
MD5

9706ff18ad84be5c698f4ab7a8281bff
SHA1

4185e6bc2543925d96babb928a15f8dfd84027d8
SHA256

0a63a636528473bd9ae6170a601ebf535de5eb0d4700dd653345bad8833c4bc9
SHA512

fef75d0c0852e5ae5f8160f711b0c0d7d2c45529fbb863be9d3aee429e8f736477d353f7ae1541101e125658c2a9534596bfbef8e917a6a438df61ae98d1d711

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Decoder.exe

pid process

1648 Decoder.exe

pid	process
1648	Decoder.exe

Drops startup file 2 IoCs

Processes:

Decoder.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows driver update.exe	Decoder.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows driver update.exe	Decoder.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
5 api.ipify.org
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1408 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1668 timeout.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Decoder.exe

pid process

1648 Decoder.exe

flow	ioc
4	api.ipify.org
5	api.ipify.org

pid	process
1408	schtasks.exe

pid	process
1668	timeout.exe

pid	process
1648	Decoder.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

0a63a636528473bd9ae6170a601ebf535de5eb0d4700dd653345bad8833c4bc9.exeDecoder.exe

description	pid	process
Token: SeDebugPrivilege	360	0a63a636528473bd9ae6170a601ebf535de5eb0d4700dd653345bad8833c4bc9.exe
Token: SeDebugPrivilege	1648	Decoder.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

0a63a636528473bd9ae6170a601ebf535de5eb0d4700dd653345bad8833c4bc9.execmd.exeDecoder.exe

description	pid	process	target process
PID 360 wrote to memory of 1648	360	0a63a636528473bd9ae6170a601ebf535de5eb0d4700dd653345bad8833c4bc9.exe	Decoder.exe
PID 360 wrote to memory of 1648	360	0a63a636528473bd9ae6170a601ebf535de5eb0d4700dd653345bad8833c4bc9.exe	Decoder.exe
PID 360 wrote to memory of 1648	360	0a63a636528473bd9ae6170a601ebf535de5eb0d4700dd653345bad8833c4bc9.exe	Decoder.exe
PID 360 wrote to memory of 1528	360	0a63a636528473bd9ae6170a601ebf535de5eb0d4700dd653345bad8833c4bc9.exe	cmd.exe
PID 360 wrote to memory of 1528	360	0a63a636528473bd9ae6170a601ebf535de5eb0d4700dd653345bad8833c4bc9.exe	cmd.exe
PID 360 wrote to memory of 1528	360	0a63a636528473bd9ae6170a601ebf535de5eb0d4700dd653345bad8833c4bc9.exe	cmd.exe
PID 360 wrote to memory of 1576	360	0a63a636528473bd9ae6170a601ebf535de5eb0d4700dd653345bad8833c4bc9.exe	cmd.exe
PID 360 wrote to memory of 1576	360	0a63a636528473bd9ae6170a601ebf535de5eb0d4700dd653345bad8833c4bc9.exe	cmd.exe
PID 360 wrote to memory of 1576	360	0a63a636528473bd9ae6170a601ebf535de5eb0d4700dd653345bad8833c4bc9.exe	cmd.exe
PID 1576 wrote to memory of 1668	1576	cmd.exe	timeout.exe
PID 1576 wrote to memory of 1668	1576	cmd.exe	timeout.exe
PID 1576 wrote to memory of 1668	1576	cmd.exe	timeout.exe
PID 1648 wrote to memory of 1408	1648	Decoder.exe	schtasks.exe
PID 1648 wrote to memory of 1408	1648	Decoder.exe	schtasks.exe
PID 1648 wrote to memory of 1408	1648	Decoder.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\0a63a636528473bd9ae6170a601ebf535de5eb0d4700dd653345bad8833c4bc9.exe
"C:\Users\Admin\AppData\Local\Temp\0a63a636528473bd9ae6170a601ebf535de5eb0d4700dd653345bad8833c4bc9.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:360

C:\ProgramData\Decoder.exe
"C:\ProgramData\Decoder.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "Windows Services" /tr "\systems32_bit\systems32.exe" /f
3⤵
- Creates scheduled task(s)
PID:1408

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\.cmd""
2⤵
PID:1528

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp756E.tmp.cmd""
2⤵
- Suspicious use of WriteProcessMemory
PID:1576

C:\Windows\system32\timeout.exe
timeout 4
3⤵
- Delays execution with timeout.exe
PID:1668

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Decoder.exe
MD5
e753a9a4c3a393d9eccc31e5c6aded66

SHA1
5501ae71598925711dbee54f6ee1c827dd01d845

SHA256
52773fccbe6883ca7465ffe857c3fe7193521f0807bd8462f95bd4ad73be9867

SHA512
ee03d79cd24db07c3466cc602a657c9eb33119267b591a64a0d9215e3a80a24e3c435275ccfb5ffd7356def5bf717c5f2d8bc9a5b2daf1950ecf951b5e614c2e

Download Submit
C:\ProgramData\Decoder.exe
MD5
e753a9a4c3a393d9eccc31e5c6aded66

SHA1
5501ae71598925711dbee54f6ee1c827dd01d845

SHA256
52773fccbe6883ca7465ffe857c3fe7193521f0807bd8462f95bd4ad73be9867

SHA512
ee03d79cd24db07c3466cc602a657c9eb33119267b591a64a0d9215e3a80a24e3c435275ccfb5ffd7356def5bf717c5f2d8bc9a5b2daf1950ecf951b5e614c2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\.cmd
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp756E.tmp.cmd
MD5
ed993aa24dd667137794ea2c12406438

SHA1
970995856d45820cb4994dcda88561863a284be7

SHA256
a56f6c11129e6f671b6ae76ee626003fa8ca63c80e63b391b1dd06208550405c

SHA512
77125359ba9efd772044a94fa72fb40d713720fd5611e9c8cc5744d0fda8394e290524e44fd77af1dc0d9f731d49ef3ac5defc3e72433d70e9009aaa52747141

Download Submit
memory/360-57-0x000000001AD20000-0x000000001AD22000-memory.dmp

Filesize
8KB

Download
memory/360-59-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/360-60-0x000000001B020000-0x000000001B10A000-memory.dmp

Filesize
936KB

Download
memory/360-61-0x0000000001EB0000-0x0000000001EB6000-memory.dmp

Filesize
24KB

Download
memory/360-58-0x000000001B790000-0x000000001B886000-memory.dmp

Filesize
984KB

Download
memory/360-54-0x000007FEF5C00000-0x000007FEF65EC000-memory.dmp

Filesize
9.9MB

Download
memory/360-56-0x000000001ADA0000-0x000000001AE44000-memory.dmp

Filesize
656KB

Download
memory/360-55-0x0000000000120000-0x0000000000274000-memory.dmp

Filesize
1.3MB

Download
memory/1648-64-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/1648-65-0x000007FEF5C00000-0x000007FEF65EC000-memory.dmp

Filesize
9.9MB

Download
memory/1648-68-0x000000001BA20000-0x000000001BA22000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads