Analysis

  • max time kernel
    158s
  • max time network
    173s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    12-05-2022 16:16

General

  • Target

    2014-06-12_djylh.exe

  • Size

    1.0MB

  • MD5

    18b6865da4d3970fa3c102731ca82d96

  • SHA1

    39f2dc79978a6bf937aa588998b14ab05b70ff83

  • SHA256

    485a5454645f5d90d1b3097336b08dcaa9d4b49db9738a2f953e81081002600d

  • SHA512

    b99c73cb74f298e608a66353309fd5cde38cfeee552cb9c05d2a10e237fda421455c3acd7e435040d15162cf871cb425c9f7098ec6dcfbb2f90ee91a3b965486

Score
8/10
upx

Malware Config

Signatures

  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2014-06-12_djylh.exe
    "C:\Users\Admin\AppData\Local\Temp\2014-06-12_djylh.exe"
    1⤵
    • Enumerates connected drives
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1724
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x18c
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:944

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1724-54-0x0000000075381000-0x0000000075383000-memory.dmp
    Filesize

    8KB

  • memory/1724-55-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

  • memory/1724-56-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

  • memory/1724-57-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

  • memory/1724-59-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

  • memory/1724-61-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

  • memory/1724-63-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

  • memory/1724-65-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

  • memory/1724-67-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

  • memory/1724-69-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

  • memory/1724-73-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

  • memory/1724-71-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

  • memory/1724-75-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

  • memory/1724-79-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

  • memory/1724-77-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

  • memory/1724-81-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

  • memory/1724-85-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

  • memory/1724-83-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

  • memory/1724-87-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

  • memory/1724-89-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

  • memory/1724-95-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

  • memory/1724-93-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

  • memory/1724-91-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

  • memory/1724-97-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

  • memory/1724-98-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB