644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9

General

Target

644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe
Size

6KB
MD5

058b79d66126720436a4577f52c30b16
SHA1

3156ac1d124a2959b20e519623d12403b0be8199
SHA256

644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9
SHA512

97e23e4b7676379a5da28f7b956fedd2d334976feb4cf970206517bd3c7e6aee68d835a37e2f55aae57f14d253e73f9d96cd176436b3b65b4d20718bfd448ddf
SSDEEP

192:qe8g+qaw4Dh+DEKoUi1C4l9ARZe1Xj6q:qe8g+7t+DZlYmI1Xz

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1960-55-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1640	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLsID\{91AA45D0-4D9E-4EC4-ABAE-AE30F7FCCD3D}\InprocServer32	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLsID	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91AA45D0-4D9E-4EC4-ABAE-AE30F7FCCD3D}	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91AA45D0-4D9E-4EC4-ABAE-AE30F7FCCD3D}\InprocServer32	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91AA45D0-4D9E-4EC4-ABAE-AE30F7FCCD3D}\InprocServer32\ = "C:\\Windows\\SysWow64\\JTsfDEXY4s.dll"	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91AA45D0-4D9E-4EC4-ABAE-AE30F7FCCD3D}\InprocServer32\ThreadingModel = "Apartment"	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1960	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	1960	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe
Token: SeDebugPrivilege	1960	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe
Token: SeDebugPrivilege	1960	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe
Token: SeDebugPrivilege	1960	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe
Token: SeDebugPrivilege	1960	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe
Token: SeDebugPrivilege	1960	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe
Token: SeDebugPrivilege	1960	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe
Token: SeDebugPrivilege	1960	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe
Token: SeDebugPrivilege	1960	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe
Token: SeDebugPrivilege	1960	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe
Token: SeDebugPrivilege	1960	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe
Token: SeDebugPrivilege	1960	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe
Token: SeDebugPrivilege	1960	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe
Token: SeDebugPrivilege	1960	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe
Token: SeDebugPrivilege	1960	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe
Token: SeDebugPrivilege	1960	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe
Token: SeDebugPrivilege	1960	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe
Token: SeDebugPrivilege	1960	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe
Token: SeDebugPrivilege	1960	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe
Token: SeDebugPrivilege	1960	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe
Token: SeDebugPrivilege	1960	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe
Token: SeDebugPrivilege	1960	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe
Token: SeDebugPrivilege	1960	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe
Token: SeDebugPrivilege	1960	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe
Token: SeDebugPrivilege	1960	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1640	1960	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe	26
PID 1960 wrote to memory of 1640	1960	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe	26
PID 1960 wrote to memory of 1640	1960	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe	26
PID 1960 wrote to memory of 1640	1960	644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe	26

C:\Users\Admin\AppData\Local\Temp\644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe
"C:\Users\Admin\AppData\Local\Temp\644c18e3b9d98b7476d9eed58e1655244e6be64af669927322787c0ac5acb7e9.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\644C18~1.EXE >> NUL
  2⤵
  - Deletes itself
  PID:1640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1640-56-0x0000000000000000-mapping.dmp

Download
memory/1960-54-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/1960-55-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing