3dafbf5e6f2e6660ee40b2de01a5edfa45facd84b1f50bc6da4c0b991c6fd902

General

Target

3dafbf5e6f2e6660ee40b2de01a5edfa45facd84b1f50bc6da4c0b991c6fd902.exe
Size

399KB
MD5

26a0916bad2656e393c961d9ca4e66c3
SHA1

f0e76ce5081fba1a00291491bee120c7e8b4c492
SHA256

3dafbf5e6f2e6660ee40b2de01a5edfa45facd84b1f50bc6da4c0b991c6fd902
SHA512

4662d9ad3ec26f85207c05fa7c5f10467be92b40e17be0e9c560263b3a4808c4d5ee6a015a9e04cb51f7712b1f7b6bb3c01d3a48e4557aa592adfa1fb9836cb6
SSDEEP

6144:2wFB0iQ/M0hPoV0z1MN9S6a8yuZsVYqmxsqZJlfRaShWuhPAfba4PLpg/5927x:L0ih2oOW9HvZsOqTafZauUf+4DO32

Score

8^/10

evasion persistence upx

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Executes dropped EXE 1 IoCs

pid	Process
1180	YWjcrFuitUsqdav.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1980-56-0x0000000000600000-0x0000000000668000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
1980	3dafbf5e6f2e6660ee40b2de01a5edfa45facd84b1f50bc6da4c0b991c6fd902.exe
1980	3dafbf5e6f2e6660ee40b2de01a5edfa45facd84b1f50bc6da4c0b991c6fd902.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run	3dafbf5e6f2e6660ee40b2de01a5edfa45facd84b1f50bc6da4c0b991c6fd902.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\YWjcrFuitUsqdav = "C:\\ProgramData\\YWjcrFuitUsqdav.exe"	3dafbf5e6f2e6660ee40b2de01a5edfa45facd84b1f50bc6da4c0b991c6fd902.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Download	3dafbf5e6f2e6660ee40b2de01a5edfa45facd84b1f50bc6da4c0b991c6fd902.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	3dafbf5e6f2e6660ee40b2de01a5edfa45facd84b1f50bc6da4c0b991c6fd902.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1980	3dafbf5e6f2e6660ee40b2de01a5edfa45facd84b1f50bc6da4c0b991c6fd902.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1180	1980	3dafbf5e6f2e6660ee40b2de01a5edfa45facd84b1f50bc6da4c0b991c6fd902.exe	28
PID 1980 wrote to memory of 1180	1980	3dafbf5e6f2e6660ee40b2de01a5edfa45facd84b1f50bc6da4c0b991c6fd902.exe	28
PID 1980 wrote to memory of 1180	1980	3dafbf5e6f2e6660ee40b2de01a5edfa45facd84b1f50bc6da4c0b991c6fd902.exe	28
PID 1980 wrote to memory of 1180	1980	3dafbf5e6f2e6660ee40b2de01a5edfa45facd84b1f50bc6da4c0b991c6fd902.exe	28

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	3dafbf5e6f2e6660ee40b2de01a5edfa45facd84b1f50bc6da4c0b991c6fd902.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	3dafbf5e6f2e6660ee40b2de01a5edfa45facd84b1f50bc6da4c0b991c6fd902.exe

C:\Users\Admin\AppData\Local\Temp\3dafbf5e6f2e6660ee40b2de01a5edfa45facd84b1f50bc6da4c0b991c6fd902.exe
"C:\Users\Admin\AppData\Local\Temp\3dafbf5e6f2e6660ee40b2de01a5edfa45facd84b1f50bc6da4c0b991c6fd902.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1980
- C:\ProgramData\YWjcrFuitUsqdav.exe
  "C:\ProgramData\YWjcrFuitUsqdav.exe"
  2⤵
  - Executes dropped EXE
  PID:1180

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\YWjcrFuitUsqdav.exe

Filesize
399KB

MD5
26a0916bad2656e393c961d9ca4e66c3

SHA1
f0e76ce5081fba1a00291491bee120c7e8b4c492

SHA256
3dafbf5e6f2e6660ee40b2de01a5edfa45facd84b1f50bc6da4c0b991c6fd902

SHA512
4662d9ad3ec26f85207c05fa7c5f10467be92b40e17be0e9c560263b3a4808c4d5ee6a015a9e04cb51f7712b1f7b6bb3c01d3a48e4557aa592adfa1fb9836cb6

Download Submit
\ProgramData\YWjcrFuitUsqdav.exe

Filesize
399KB

MD5
26a0916bad2656e393c961d9ca4e66c3

SHA1
f0e76ce5081fba1a00291491bee120c7e8b4c492

SHA256
3dafbf5e6f2e6660ee40b2de01a5edfa45facd84b1f50bc6da4c0b991c6fd902

SHA512
4662d9ad3ec26f85207c05fa7c5f10467be92b40e17be0e9c560263b3a4808c4d5ee6a015a9e04cb51f7712b1f7b6bb3c01d3a48e4557aa592adfa1fb9836cb6

Download Submit
\ProgramData\YWjcrFuitUsqdav.exe

Filesize
399KB

MD5
26a0916bad2656e393c961d9ca4e66c3

SHA1
f0e76ce5081fba1a00291491bee120c7e8b4c492

SHA256
3dafbf5e6f2e6660ee40b2de01a5edfa45facd84b1f50bc6da4c0b991c6fd902

SHA512
4662d9ad3ec26f85207c05fa7c5f10467be92b40e17be0e9c560263b3a4808c4d5ee6a015a9e04cb51f7712b1f7b6bb3c01d3a48e4557aa592adfa1fb9836cb6

Download Submit
memory/1980-54-0x0000000000600000-0x0000000000668000-memory.dmp

Filesize
416KB

Download
memory/1980-55-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/1980-56-0x0000000000600000-0x0000000000668000-memory.dmp

Filesize
416KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads