e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3

General

Target

e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe
Size

905KB
MD5

6a07b82a873405eeb460afec9a135680
SHA1

d299438355ebaf095999b510f7fc6ab1325f9b12
SHA256

e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3
SHA512

6c3dcdbb1fc954abcf504be8dda27fe281874b0baa4390e9b66a30434606282d930cb2151c2fcdde598b97d0fc8a5db56d600b162d7fc4e661416e0a71c39e13
SSDEEP

24576:4KUPqFwkyC17SRkgH3D19KDAwnsvi846RvArazQ:7UPqFwkP1AkgHz/KD/nsvimorazQ

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/108-54-0x0000000000400000-0x000000000056F000-memory.dmp	upx
behavioral1/memory/108-59-0x0000000000400000-0x000000000056F000-memory.dmp	upx
behavioral1/memory/108-60-0x0000000000400000-0x000000000056F000-memory.dmp	upx

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe
File opened (read-only)	\??\E:	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe
File opened (read-only)	\??\F:	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe
File opened (read-only)	\??\R:	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe
File opened (read-only)	\??\W:	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe
File opened (read-only)	\??\Q:	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe
File opened (read-only)	\??\G:	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe
File opened (read-only)	\??\H:	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe
File opened (read-only)	\??\J:	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe
File opened (read-only)	\??\K:	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe
File opened (read-only)	\??\M:	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe
File opened (read-only)	\??\N:	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe
File opened (read-only)	\??\O:	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe
File opened (read-only)	\??\Y:	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe
File opened (read-only)	\??\Z:	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe
File opened (read-only)	\??\I:	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe
File opened (read-only)	\??\L:	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe
File opened (read-only)	\??\P:	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe
File opened (read-only)	\??\S:	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe
File opened (read-only)	\??\T:	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe
File opened (read-only)	\??\U:	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe
File opened (read-only)	\??\X:	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe
File opened (read-only)	\??\A:	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe
File opened (read-only)	\??\V:	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
904	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
904	vlc.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: 33	1188	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1188	AUDIODG.EXE
Token: 33	1188	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1188	AUDIODG.EXE
Token: 33	904	vlc.exe
Token: SeIncBasePriorityPrivilege	904	vlc.exe
Token: SeDebugPrivilege	108	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe

Suspicious use of FindShellTrayWindow 16 IoCs

pid	Process
904	vlc.exe
904	vlc.exe
904	vlc.exe
904	vlc.exe
904	vlc.exe
904	vlc.exe
904	vlc.exe
904	vlc.exe
904	vlc.exe
904	vlc.exe
904	vlc.exe
904	vlc.exe
904	vlc.exe
904	vlc.exe
904	vlc.exe
904	vlc.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
904	vlc.exe
904	vlc.exe
904	vlc.exe
904	vlc.exe
904	vlc.exe
904	vlc.exe
904	vlc.exe
904	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
904	vlc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 108 wrote to memory of 904	108	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe	27
PID 108 wrote to memory of 904	108	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe	27
PID 108 wrote to memory of 904	108	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe	27
PID 108 wrote to memory of 904	108	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe	27
PID 108 wrote to memory of 1760	108	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe	31
PID 108 wrote to memory of 1760	108	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe	31
PID 108 wrote to memory of 1760	108	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe	31
PID 108 wrote to memory of 1760	108	e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe	31

C:\Users\Admin\AppData\Local\Temp\e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe
"C:\Users\Admin\AppData\Local\Temp\e19de6a2d101456357591ce0a32a85130e1b0a49c3c5026190e546c29904a9a3.exe"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:108
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\cb118_toWMV_8a.wmv"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:904
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE" "http://www.a88b88.com/--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------.asp?id=wii&md5=65d8e3b9b3facdcee8d9c707680abc33"
  2⤵
  PID:1760

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0xc4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1188

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cb118_toWMV_8a.wmv

Filesize
144KB

MD5
16304af737353374963f706e7d0fc7f7

SHA1
ad82bed6a0a8adc73b2cb60e39b26c67165a26ce

SHA256
d3fedb40ee73acb6244aac3b28474941c78947117b5fce5cb1cef3ae4cd79078

SHA512
115d9e5c58997ae5e69bf120d8274b50554c83cd9f914260cfe402f58c5238379c9bd8157f74868a39d2a5a5028c4d69895e72b4aa05a765655be00fa4a99bdd

Download Submit
memory/108-54-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/108-55-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download
memory/108-59-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/108-60-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/904-56-0x0000000000000000-mapping.dmp

Download
memory/904-57-0x000007FEFBF71000-0x000007FEFBF73000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing