d3e6cd3d47c14dfb35db0bbfad03996744c639489a154f92d87effe01941f6df

General

Target

d3e6cd3d47c14dfb35db0bbfad03996744c639489a154f92d87effe01941f6df.exe
Size

581KB
MD5

af7a43d32c533414e949cbe06740d21d
SHA1

025961e90a6a6e78e35c9628440dbcd2deb42056
SHA256

d3e6cd3d47c14dfb35db0bbfad03996744c639489a154f92d87effe01941f6df
SHA512

9f2716eeeeac734b88880154880837ce9b8b2fe54914b2c3a170220a8cf3e24cca62da483f838149e70566200ad496032da15c9521411de70be4f643ed61080e
SSDEEP

12288:RQFagl4ZjL++kpFDI+4hPBH1S4+gHRMEM9LCB9Gl/DN:RQFNC+fI+g1S4+gHOt9LCc/D

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1928-134-0x0000000002330000-0x0000000002462000-memory.dmp	upx
behavioral2/memory/1928-137-0x0000000002330000-0x0000000002462000-memory.dmp	upx
behavioral2/memory/1928-138-0x0000000002330000-0x0000000002462000-memory.dmp	upx
behavioral2/memory/1928-139-0x0000000002330000-0x0000000002462000-memory.dmp	upx
behavioral2/memory/4896-141-0x00000000021A0000-0x00000000022D2000-memory.dmp	upx
behavioral2/memory/4896-144-0x00000000021A0000-0x00000000022D2000-memory.dmp	upx
behavioral2/memory/4896-145-0x00000000021A0000-0x00000000022D2000-memory.dmp	upx
behavioral2/memory/4896-146-0x00000000021A0000-0x00000000022D2000-memory.dmp	upx
behavioral2/memory/4896-147-0x00000000021A0000-0x00000000022D2000-memory.dmp	upx
behavioral2/memory/4896-148-0x00000000021A0000-0x00000000022D2000-memory.dmp	upx
behavioral2/memory/1928-149-0x0000000002330000-0x0000000002462000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{20E2125D-5D4F-4C5D-8990-021F61FA5E50}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{77F1BADF-2142-4621-8423-2EFEF6D2E0ED}.catalogItem	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1928	d3e6cd3d47c14dfb35db0bbfad03996744c639489a154f92d87effe01941f6df.exe
1928	d3e6cd3d47c14dfb35db0bbfad03996744c639489a154f92d87effe01941f6df.exe
1928	d3e6cd3d47c14dfb35db0bbfad03996744c639489a154f92d87effe01941f6df.exe
1928	d3e6cd3d47c14dfb35db0bbfad03996744c639489a154f92d87effe01941f6df.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1928	d3e6cd3d47c14dfb35db0bbfad03996744c639489a154f92d87effe01941f6df.exe
Token: SeCreatePagefilePrivilege	1928	d3e6cd3d47c14dfb35db0bbfad03996744c639489a154f92d87effe01941f6df.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1928	d3e6cd3d47c14dfb35db0bbfad03996744c639489a154f92d87effe01941f6df.exe
1928	d3e6cd3d47c14dfb35db0bbfad03996744c639489a154f92d87effe01941f6df.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 4896	1928	d3e6cd3d47c14dfb35db0bbfad03996744c639489a154f92d87effe01941f6df.exe	80
PID 1928 wrote to memory of 4896	1928	d3e6cd3d47c14dfb35db0bbfad03996744c639489a154f92d87effe01941f6df.exe	80
PID 1928 wrote to memory of 4896	1928	d3e6cd3d47c14dfb35db0bbfad03996744c639489a154f92d87effe01941f6df.exe	80

C:\Users\Admin\AppData\Local\Temp\d3e6cd3d47c14dfb35db0bbfad03996744c639489a154f92d87effe01941f6df.exe
"C:\Users\Admin\AppData\Local\Temp\d3e6cd3d47c14dfb35db0bbfad03996744c639489a154f92d87effe01941f6df.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Users\Admin\AppData\Local\Temp\d3e6cd3d47c14dfb35db0bbfad03996744c639489a154f92d87effe01941f6df.exe
  "C:\Users\Admin\AppData\Local\Temp\d3e6cd3d47c14dfb35db0bbfad03996744c639489a154f92d87effe01941f6df.exe" /_ShowProgress
  2⤵
  PID:4896

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:1268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1928-149-0x0000000002330000-0x0000000002462000-memory.dmp

Filesize
1.2MB

Download
memory/1928-133-0x00000000005E0000-0x0000000000672000-memory.dmp

Filesize
584KB

Download
memory/1928-134-0x0000000002330000-0x0000000002462000-memory.dmp

Filesize
1.2MB

Download
memory/1928-137-0x0000000002330000-0x0000000002462000-memory.dmp

Filesize
1.2MB

Download
memory/1928-138-0x0000000002330000-0x0000000002462000-memory.dmp

Filesize
1.2MB

Download
memory/1928-139-0x0000000002330000-0x0000000002462000-memory.dmp

Filesize
1.2MB

Download
memory/1928-132-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4896-144-0x00000000021A0000-0x00000000022D2000-memory.dmp

Filesize
1.2MB

Download
memory/4896-145-0x00000000021A0000-0x00000000022D2000-memory.dmp

Filesize
1.2MB

Download
memory/4896-146-0x00000000021A0000-0x00000000022D2000-memory.dmp

Filesize
1.2MB

Download
memory/4896-147-0x00000000021A0000-0x00000000022D2000-memory.dmp

Filesize
1.2MB

Download
memory/4896-148-0x00000000021A0000-0x00000000022D2000-memory.dmp

Filesize
1.2MB

Download
memory/4896-141-0x00000000021A0000-0x00000000022D2000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads