24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776

General

Target

24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exe
Size

2.2MB
MD5

8fc2239d034369c87e1d60c833867f28
SHA1

267a4b5e2a12337590a7feff8f351afc46a62ee6
SHA256

24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776
SHA512

fafbfecf2b04f16729233720a1df394d265a9e44e4d6f44e9e72731d2d8fc285cbf82f779352eb1622d95c62ddbf3337bc20c84df84c8e3039ec64c043d616ed
SSDEEP

24576:9+GY1v5Px/ZvfKs9/FGAykFFo7oydYqHW9MG0+yGTcMXoOH6W24:9AvlxNfXw3WyMyCMgEG1Lp

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Protector-javj.exe

pid process

2036 Protector-javj.exe

pid	process
2036	Protector-javj.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/768-55-0x0000000000400000-0x0000000000992000-memory.dmp	upx
behavioral1/memory/768-56-0x0000000000400000-0x000000000076B000-memory.dmp	upx
behavioral1/memory/768-58-0x0000000000400000-0x0000000000992000-memory.dmp	upx
behavioral1/memory/2036-67-0x0000000000400000-0x0000000000992000-memory.dmp	upx
behavioral1/memory/2036-70-0x0000000000400000-0x0000000000992000-memory.dmp	upx
behavioral1/memory/2036-72-0x0000000000400000-0x000000000076B000-memory.dmp	upx
behavioral1/memory/768-69-0x0000000000400000-0x000000000076B000-memory.dmp	upx

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1116 cmd.exe

pid	process
1116	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exe

pid	process
768	24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exe
768	24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exeProtector-javj.exe

description	pid	process
Token: SeDebugPrivilege	768	24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exe
Token: SeDebugPrivilege	2036	Protector-javj.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exeProtector-javj.exe

pid process

768 24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exe
2036 Protector-javj.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exe

description	pid	process	target process
PID 768 wrote to memory of 2036	768	24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exe	Protector-javj.exe
PID 768 wrote to memory of 2036	768	24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exe	Protector-javj.exe
PID 768 wrote to memory of 2036	768	24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exe	Protector-javj.exe
PID 768 wrote to memory of 2036	768	24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exe	Protector-javj.exe
PID 768 wrote to memory of 1116	768	24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exe	cmd.exe
PID 768 wrote to memory of 1116	768	24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exe	cmd.exe
PID 768 wrote to memory of 1116	768	24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exe	cmd.exe
PID 768 wrote to memory of 1116	768	24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exe
"C:\Users\Admin\AppData\Local\Temp\24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:768

C:\Users\Admin\AppData\Roaming\Protector-javj.exe
C:\Users\Admin\AppData\Roaming\Protector-javj.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2036

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\24A586~1.EXE" >> NUL
2⤵
- Deletes itself
PID:1116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Protector-javj.exe

Filesize
2.2MB

MD5
8fc2239d034369c87e1d60c833867f28

SHA1
267a4b5e2a12337590a7feff8f351afc46a62ee6

SHA256
24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776

SHA512
fafbfecf2b04f16729233720a1df394d265a9e44e4d6f44e9e72731d2d8fc285cbf82f779352eb1622d95c62ddbf3337bc20c84df84c8e3039ec64c043d616ed

Download Submit
C:\Users\Admin\AppData\Roaming\Protector-javj.exe

Filesize
2.2MB

MD5
8fc2239d034369c87e1d60c833867f28

SHA1
267a4b5e2a12337590a7feff8f351afc46a62ee6

SHA256
24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776

SHA512
fafbfecf2b04f16729233720a1df394d265a9e44e4d6f44e9e72731d2d8fc285cbf82f779352eb1622d95c62ddbf3337bc20c84df84c8e3039ec64c043d616ed

Download Submit
\Users\Admin\AppData\Roaming\Protector-javj.exe

Filesize
2.2MB

MD5
8fc2239d034369c87e1d60c833867f28

SHA1
267a4b5e2a12337590a7feff8f351afc46a62ee6

SHA256
24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776

SHA512
fafbfecf2b04f16729233720a1df394d265a9e44e4d6f44e9e72731d2d8fc285cbf82f779352eb1622d95c62ddbf3337bc20c84df84c8e3039ec64c043d616ed

Download Submit
\Users\Admin\AppData\Roaming\Protector-javj.exe

Filesize
2.2MB

MD5
8fc2239d034369c87e1d60c833867f28

SHA1
267a4b5e2a12337590a7feff8f351afc46a62ee6

SHA256
24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776

SHA512
fafbfecf2b04f16729233720a1df394d265a9e44e4d6f44e9e72731d2d8fc285cbf82f779352eb1622d95c62ddbf3337bc20c84df84c8e3039ec64c043d616ed

Download Submit
memory/768-58-0x0000000000400000-0x0000000000992000-memory.dmp

Filesize
5.6MB

Download
memory/768-71-0x0000000075600000-0x0000000075679000-memory.dmp

Filesize
484KB

Download
memory/768-69-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/768-57-0x0000000075600000-0x0000000075679000-memory.dmp

Filesize
484KB

Download
memory/768-56-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/768-55-0x0000000000400000-0x0000000000992000-memory.dmp

Filesize
5.6MB

Download
memory/768-54-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download
memory/1116-64-0x0000000000000000-mapping.dmp

Download
memory/2036-67-0x0000000000400000-0x0000000000992000-memory.dmp

Filesize
5.6MB

Download
memory/2036-68-0x0000000075600000-0x0000000075679000-memory.dmp

Filesize
484KB

Download
memory/2036-70-0x0000000000400000-0x0000000000992000-memory.dmp

Filesize
5.6MB

Download
memory/2036-72-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/2036-61-0x0000000000000000-mapping.dmp

Download
memory/2036-73-0x0000000075600000-0x0000000075679000-memory.dmp

Filesize
484KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads