d801b42d77a66f7e58d8c8fa69688bfded52c323ec02ef0b9a97b9ddb7df9ae1

General

Target

d801b42d77a66f7e58d8c8fa69688bfded52c323ec02ef0b9a97b9ddb7df9ae1.exe
Size

64KB
MD5

07870fd0c9ef09a561c2f956d7c11970
SHA1

0eb97c8472c78cb4fa8e673659b60a81573bb933
SHA256

d801b42d77a66f7e58d8c8fa69688bfded52c323ec02ef0b9a97b9ddb7df9ae1
SHA512

e7a20461f9135f195a1657f45827ffde657a3475f41c5af66b573649faff27f0e259dc674c8cbb66329e3bd94facd03d834517a9dcaf808348886a05d50cef8a
SSDEEP

1536:+STmeqmamccVj6tob+Kj0iNyPOPrc7CVNOlcSJ6uE:dnaXxtosYy2P3NfSJ+

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1600	gyidtf.exe

Deletes itself 1 IoCs

pid	Process
1272	explorer.exe

Loads dropped DLL 2 IoCs

pid	Process
1392	d801b42d77a66f7e58d8c8fa69688bfded52c323ec02ef0b9a97b9ddb7df9ae1.exe
1392	d801b42d77a66f7e58d8c8fa69688bfded52c323ec02ef0b9a97b9ddb7df9ae1.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	d801b42d77a66f7e58d8c8fa69688bfded52c323ec02ef0b9a97b9ddb7df9ae1.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	gyidtf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mgxdmt = "c:\\program files (x86)\\common files\\system\\gyidtf.exe"	gyidtf.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1392 set thread context of 1272	1392	d801b42d77a66f7e58d8c8fa69688bfded52c323ec02ef0b9a97b9ddb7df9ae1.exe	28

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files (x86)\common files\system\gyidtf.exe	d801b42d77a66f7e58d8c8fa69688bfded52c323ec02ef0b9a97b9ddb7df9ae1.exe
File created	\??\c:\program files (x86)\common files\system\gyidtf.exe	d801b42d77a66f7e58d8c8fa69688bfded52c323ec02ef0b9a97b9ddb7df9ae1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1600	gyidtf.exe
1600	gyidtf.exe
1600	gyidtf.exe
1600	gyidtf.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1392	d801b42d77a66f7e58d8c8fa69688bfded52c323ec02ef0b9a97b9ddb7df9ae1.exe
Token: SeIncBasePriorityPrivilege	1392	d801b42d77a66f7e58d8c8fa69688bfded52c323ec02ef0b9a97b9ddb7df9ae1.exe
Token: 33	1600	gyidtf.exe
Token: SeIncBasePriorityPrivilege	1600	gyidtf.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 1600	1392	d801b42d77a66f7e58d8c8fa69688bfded52c323ec02ef0b9a97b9ddb7df9ae1.exe	27
PID 1392 wrote to memory of 1600	1392	d801b42d77a66f7e58d8c8fa69688bfded52c323ec02ef0b9a97b9ddb7df9ae1.exe	27
PID 1392 wrote to memory of 1600	1392	d801b42d77a66f7e58d8c8fa69688bfded52c323ec02ef0b9a97b9ddb7df9ae1.exe	27
PID 1392 wrote to memory of 1600	1392	d801b42d77a66f7e58d8c8fa69688bfded52c323ec02ef0b9a97b9ddb7df9ae1.exe	27
PID 1600 wrote to memory of 1212	1600	gyidtf.exe	9
PID 1392 wrote to memory of 1272	1392	d801b42d77a66f7e58d8c8fa69688bfded52c323ec02ef0b9a97b9ddb7df9ae1.exe	28
PID 1392 wrote to memory of 1272	1392	d801b42d77a66f7e58d8c8fa69688bfded52c323ec02ef0b9a97b9ddb7df9ae1.exe	28
PID 1392 wrote to memory of 1272	1392	d801b42d77a66f7e58d8c8fa69688bfded52c323ec02ef0b9a97b9ddb7df9ae1.exe	28
PID 1392 wrote to memory of 1272	1392	d801b42d77a66f7e58d8c8fa69688bfded52c323ec02ef0b9a97b9ddb7df9ae1.exe	28
PID 1600 wrote to memory of 1212	1600	gyidtf.exe	9
PID 1392 wrote to memory of 1272	1392	d801b42d77a66f7e58d8c8fa69688bfded52c323ec02ef0b9a97b9ddb7df9ae1.exe	28
PID 1600 wrote to memory of 1212	1600	gyidtf.exe	9
PID 1600 wrote to memory of 1212	1600	gyidtf.exe	9
PID 1600 wrote to memory of 1212	1600	gyidtf.exe	9
PID 1600 wrote to memory of 1212	1600	gyidtf.exe	9
PID 1600 wrote to memory of 1212	1600	gyidtf.exe	9
PID 1600 wrote to memory of 1212	1600	gyidtf.exe	9

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212
- C:\Users\Admin\AppData\Local\Temp\d801b42d77a66f7e58d8c8fa69688bfded52c323ec02ef0b9a97b9ddb7df9ae1.exe
  "C:\Users\Admin\AppData\Local\Temp\d801b42d77a66f7e58d8c8fa69688bfded52c323ec02ef0b9a97b9ddb7df9ae1.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1392
- - C:\program files (x86)\common files\system\gyidtf.exe
    "C:\program files (x86)\common files\system\gyidtf.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1600
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - Deletes itself
    PID:1272

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\System\gyidtf.exe

Filesize
64KB

MD5
07870fd0c9ef09a561c2f956d7c11970

SHA1
0eb97c8472c78cb4fa8e673659b60a81573bb933

SHA256
d801b42d77a66f7e58d8c8fa69688bfded52c323ec02ef0b9a97b9ddb7df9ae1

SHA512
e7a20461f9135f195a1657f45827ffde657a3475f41c5af66b573649faff27f0e259dc674c8cbb66329e3bd94facd03d834517a9dcaf808348886a05d50cef8a

Download Submit
\Program Files (x86)\Common Files\System\gyidtf.exe

Filesize
64KB

MD5
07870fd0c9ef09a561c2f956d7c11970

SHA1
0eb97c8472c78cb4fa8e673659b60a81573bb933

SHA256
d801b42d77a66f7e58d8c8fa69688bfded52c323ec02ef0b9a97b9ddb7df9ae1

SHA512
e7a20461f9135f195a1657f45827ffde657a3475f41c5af66b573649faff27f0e259dc674c8cbb66329e3bd94facd03d834517a9dcaf808348886a05d50cef8a

Download Submit
\Program Files (x86)\Common Files\System\gyidtf.exe

Filesize
64KB

MD5
07870fd0c9ef09a561c2f956d7c11970

SHA1
0eb97c8472c78cb4fa8e673659b60a81573bb933

SHA256
d801b42d77a66f7e58d8c8fa69688bfded52c323ec02ef0b9a97b9ddb7df9ae1

SHA512
e7a20461f9135f195a1657f45827ffde657a3475f41c5af66b573649faff27f0e259dc674c8cbb66329e3bd94facd03d834517a9dcaf808348886a05d50cef8a

Download Submit
memory/1212-60-0x0000000002230000-0x0000000002234000-memory.dmp

Filesize
16KB

Download
memory/1212-66-0x0000000002640000-0x0000000002650000-memory.dmp

Filesize
64KB

Download
memory/1272-62-0x0000000000890EFA-mapping.dmp

Download
memory/1272-65-0x0000000074301000-0x0000000074303000-memory.dmp

Filesize
8KB

Download
memory/1392-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1392-64-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1600-57-0x0000000000000000-mapping.dmp

Download
memory/1600-68-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing