9f38a0e916a4f455dcfdd478cb3fc15e58b8920515326d03abbe8d034dd91dd2

General

Target

9f38a0e916a4f455dcfdd478cb3fc15e58b8920515326d03abbe8d034dd91dd2.exe
Size

11KB
MD5

0c3700de83375196cc6df4198d0e86f7
SHA1

35edccd196229dfe43c3a73efc5b7c3b9e1bfdb3
SHA256

9f38a0e916a4f455dcfdd478cb3fc15e58b8920515326d03abbe8d034dd91dd2
SHA512

302101cd56e7b677231ceab553f21f44ef7e07e3f48f1694a834b0f69cea5b789b0d33dd44b6d6f71ef90c3b8158e620c2e47c9dd356fb9124f11dde43d2cec0
SSDEEP

192:qSD9GfS+ZG2WMN+lEsbH00x/kHKDal92G6pjJ9j0ydJT+db3WNSe2hww+rzWEIea:jwJZtVN+ikDByCR0IJTGarzWEIea

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/872-57-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/872-65-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wmvds32.dll	9f38a0e916a4f455dcfdd478cb3fc15e58b8920515326d03abbe8d034dd91dd2.exe
File opened for modification	C:\Windows\SysWOW64\msorcl32.exe	9f38a0e916a4f455dcfdd478cb3fc15e58b8920515326d03abbe8d034dd91dd2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
872	9f38a0e916a4f455dcfdd478cb3fc15e58b8920515326d03abbe8d034dd91dd2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	872	9f38a0e916a4f455dcfdd478cb3fc15e58b8920515326d03abbe8d034dd91dd2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
872	9f38a0e916a4f455dcfdd478cb3fc15e58b8920515326d03abbe8d034dd91dd2.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 1128	872	9f38a0e916a4f455dcfdd478cb3fc15e58b8920515326d03abbe8d034dd91dd2.exe	28
PID 872 wrote to memory of 1128	872	9f38a0e916a4f455dcfdd478cb3fc15e58b8920515326d03abbe8d034dd91dd2.exe	28
PID 872 wrote to memory of 1128	872	9f38a0e916a4f455dcfdd478cb3fc15e58b8920515326d03abbe8d034dd91dd2.exe	28
PID 872 wrote to memory of 1128	872	9f38a0e916a4f455dcfdd478cb3fc15e58b8920515326d03abbe8d034dd91dd2.exe	28
PID 872 wrote to memory of 1128	872	9f38a0e916a4f455dcfdd478cb3fc15e58b8920515326d03abbe8d034dd91dd2.exe	28
PID 872 wrote to memory of 1128	872	9f38a0e916a4f455dcfdd478cb3fc15e58b8920515326d03abbe8d034dd91dd2.exe	28
PID 872 wrote to memory of 1128	872	9f38a0e916a4f455dcfdd478cb3fc15e58b8920515326d03abbe8d034dd91dd2.exe	28
PID 872 wrote to memory of 1968	872	9f38a0e916a4f455dcfdd478cb3fc15e58b8920515326d03abbe8d034dd91dd2.exe	29
PID 872 wrote to memory of 1968	872	9f38a0e916a4f455dcfdd478cb3fc15e58b8920515326d03abbe8d034dd91dd2.exe	29
PID 872 wrote to memory of 1968	872	9f38a0e916a4f455dcfdd478cb3fc15e58b8920515326d03abbe8d034dd91dd2.exe	29
PID 872 wrote to memory of 1968	872	9f38a0e916a4f455dcfdd478cb3fc15e58b8920515326d03abbe8d034dd91dd2.exe	29
PID 872 wrote to memory of 1968	872	9f38a0e916a4f455dcfdd478cb3fc15e58b8920515326d03abbe8d034dd91dd2.exe	29
PID 872 wrote to memory of 1968	872	9f38a0e916a4f455dcfdd478cb3fc15e58b8920515326d03abbe8d034dd91dd2.exe	29
PID 872 wrote to memory of 1968	872	9f38a0e916a4f455dcfdd478cb3fc15e58b8920515326d03abbe8d034dd91dd2.exe	29
PID 872 wrote to memory of 1564	872	9f38a0e916a4f455dcfdd478cb3fc15e58b8920515326d03abbe8d034dd91dd2.exe	30
PID 872 wrote to memory of 1564	872	9f38a0e916a4f455dcfdd478cb3fc15e58b8920515326d03abbe8d034dd91dd2.exe	30
PID 872 wrote to memory of 1564	872	9f38a0e916a4f455dcfdd478cb3fc15e58b8920515326d03abbe8d034dd91dd2.exe	30
PID 872 wrote to memory of 1564	872	9f38a0e916a4f455dcfdd478cb3fc15e58b8920515326d03abbe8d034dd91dd2.exe	30
PID 872 wrote to memory of 1564	872	9f38a0e916a4f455dcfdd478cb3fc15e58b8920515326d03abbe8d034dd91dd2.exe	30
PID 872 wrote to memory of 1564	872	9f38a0e916a4f455dcfdd478cb3fc15e58b8920515326d03abbe8d034dd91dd2.exe	30
PID 872 wrote to memory of 1564	872	9f38a0e916a4f455dcfdd478cb3fc15e58b8920515326d03abbe8d034dd91dd2.exe	30

C:\Users\Admin\AppData\Local\Temp\9f38a0e916a4f455dcfdd478cb3fc15e58b8920515326d03abbe8d034dd91dd2.exe
"C:\Users\Admin\AppData\Local\Temp\9f38a0e916a4f455dcfdd478cb3fc15e58b8920515326d03abbe8d034dd91dd2.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:872
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" -s C:\Windows\system32\wmvds32.dll
  2⤵
  PID:1128
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" -s C:\Windows\system32\wmvds32.dll
  2⤵
  PID:1968
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" -s C:\Windows\system32\wmvds32.dll
  2⤵
  PID:1564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/872-56-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download
memory/872-57-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/872-60-0x0000000003410000-0x0000000003413000-memory.dmp

Filesize
12KB

Download
memory/872-65-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing