4d230399444751273bb1f8f427610f8a4060750a55e2af1871b571726d4e208e

General

Target

4d230399444751273bb1f8f427610f8a4060750a55e2af1871b571726d4e208e.exe
Size

270KB
MD5

431c963b135976896a9eeb37d5f8801c
SHA1

435b2aca20902d2bba4c5a3940c7d941e03f498f
SHA256

4d230399444751273bb1f8f427610f8a4060750a55e2af1871b571726d4e208e
SHA512

604701bd9aa0f4d74d64e02ea941ec23436a2596fc0886bf305c9a6dc895c659c34c19f044ecf3bd0ba6574bf487a0f517a620b03d133d146539414523683104
SSDEEP

6144:zPvKlCm5p7cKooMCMF6Nz0Zw+PnuSpZYlJQ6PzXT+QUl85FSW:zPilCm75oXCiukYlJQ6Pe85FZ

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4104-132-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral2/memory/4356-134-0x0000000000400000-0x00000000004AA000-memory.dmp	upx
behavioral2/memory/4356-135-0x0000000000400000-0x00000000004AA000-memory.dmp	upx
behavioral2/memory/4356-136-0x0000000000400000-0x00000000004AA000-memory.dmp	upx
behavioral2/memory/4356-137-0x0000000000400000-0x00000000004AA000-memory.dmp	upx
behavioral2/memory/4356-138-0x0000000000400000-0x00000000004AA000-memory.dmp	upx
behavioral2/memory/4356-139-0x0000000000400000-0x00000000004AA000-memory.dmp	upx
behavioral2/memory/4104-140-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral2/memory/4356-141-0x0000000000400000-0x00000000004AA000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

4d230399444751273bb1f8f427610f8a4060750a55e2af1871b571726d4e208e.exe

description	pid	process	target process
PID 4104 set thread context of 4356	4104	4d230399444751273bb1f8f427610f8a4060750a55e2af1871b571726d4e208e.exe	4d230399444751273bb1f8f427610f8a4060750a55e2af1871b571726d4e208e.exe

Drops file in Program Files directory 2 IoCs

Processes:

4d230399444751273bb1f8f427610f8a4060750a55e2af1871b571726d4e208e.exe

description	ioc	process
File opened for modification	C:\Progra~1\Window~1\hyper.pif	4d230399444751273bb1f8f427610f8a4060750a55e2af1871b571726d4e208e.exe
File created	C:\Progra~1\Window~1\hyper.pif	4d230399444751273bb1f8f427610f8a4060750a55e2af1871b571726d4e208e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

4d230399444751273bb1f8f427610f8a4060750a55e2af1871b571726d4e208e.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	4d230399444751273bb1f8f427610f8a4060750a55e2af1871b571726d4e208e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	4d230399444751273bb1f8f427610f8a4060750a55e2af1871b571726d4e208e.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

4d230399444751273bb1f8f427610f8a4060750a55e2af1871b571726d4e208e.exe

description	pid	process	target process
PID 4104 wrote to memory of 4356	4104	4d230399444751273bb1f8f427610f8a4060750a55e2af1871b571726d4e208e.exe	4d230399444751273bb1f8f427610f8a4060750a55e2af1871b571726d4e208e.exe
PID 4104 wrote to memory of 4356	4104	4d230399444751273bb1f8f427610f8a4060750a55e2af1871b571726d4e208e.exe	4d230399444751273bb1f8f427610f8a4060750a55e2af1871b571726d4e208e.exe
PID 4104 wrote to memory of 4356	4104	4d230399444751273bb1f8f427610f8a4060750a55e2af1871b571726d4e208e.exe	4d230399444751273bb1f8f427610f8a4060750a55e2af1871b571726d4e208e.exe
PID 4104 wrote to memory of 4356	4104	4d230399444751273bb1f8f427610f8a4060750a55e2af1871b571726d4e208e.exe	4d230399444751273bb1f8f427610f8a4060750a55e2af1871b571726d4e208e.exe
PID 4104 wrote to memory of 4356	4104	4d230399444751273bb1f8f427610f8a4060750a55e2af1871b571726d4e208e.exe	4d230399444751273bb1f8f427610f8a4060750a55e2af1871b571726d4e208e.exe
PID 4104 wrote to memory of 4356	4104	4d230399444751273bb1f8f427610f8a4060750a55e2af1871b571726d4e208e.exe	4d230399444751273bb1f8f427610f8a4060750a55e2af1871b571726d4e208e.exe
PID 4104 wrote to memory of 4356	4104	4d230399444751273bb1f8f427610f8a4060750a55e2af1871b571726d4e208e.exe	4d230399444751273bb1f8f427610f8a4060750a55e2af1871b571726d4e208e.exe

C:\Users\Admin\AppData\Local\Temp\4d230399444751273bb1f8f427610f8a4060750a55e2af1871b571726d4e208e.exe
"C:\Users\Admin\AppData\Local\Temp\4d230399444751273bb1f8f427610f8a4060750a55e2af1871b571726d4e208e.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4104

C:\Users\Admin\AppData\Local\Temp\4d230399444751273bb1f8f427610f8a4060750a55e2af1871b571726d4e208e.exe
C:\Users\Admin\AppData\Local\Temp\4d230399444751273bb1f8f427610f8a4060750a55e2af1871b571726d4e208e.exe
2⤵
- Modifies registry class
PID:4356

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4104-132-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4104-140-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4356-134-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/4356-133-0x0000000000000000-mapping.dmp

Download
memory/4356-135-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/4356-136-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/4356-137-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/4356-138-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/4356-139-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/4356-141-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads