6fa4e5f7a546f21c5cbf518a117438bc33f941252a583a79fa730a74f849a035

Analysis

max time kernel
150s
max time network
159s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 21:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fa4e5f7a546f21c5cbf518a117438bc33f941252a583a79fa730a74f849a035.exe
Size

24KB
MD5

6b8fa20f8a6181244f532be85ef8e057
SHA1

6e00fdce8071b92864ea6b8762129055f6a1f8e5
SHA256

6fa4e5f7a546f21c5cbf518a117438bc33f941252a583a79fa730a74f849a035
SHA512

e7b4e6ee8952e4b09afdd59c680b84dbd4deb03e7f16e61d212a74cfa0ce7bd47ab977b3e7cb95ecb00eb96aec5ccf3c1772562db1ee3e952dbafc9330f8d226
SSDEEP

384:6W0igPNvfirsiTr9+q1mydZZkd/jy85sbeQaZN9rLu2nxQATO:LkNirsid0y5Kjyv69raEQA

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1968	nyrtuc.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00140000000054ab-55.dat	upx
behavioral1/memory/1392-58-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/1968-59-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/files/0x00140000000054ab-60.dat	upx
behavioral1/memory/1968-62-0x0000000000400000-0x0000000000417000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1536	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
1968	nyrtuc.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\hra33.dll	nyrtuc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\nyrtuc.exe	6fa4e5f7a546f21c5cbf518a117438bc33f941252a583a79fa730a74f849a035.exe
File opened for modification	C:\Windows\nyrtuc.exe	6fa4e5f7a546f21c5cbf518a117438bc33f941252a583a79fa730a74f849a035.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1392	6fa4e5f7a546f21c5cbf518a117438bc33f941252a583a79fa730a74f849a035.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 1536	1392	6fa4e5f7a546f21c5cbf518a117438bc33f941252a583a79fa730a74f849a035.exe	29
PID 1392 wrote to memory of 1536	1392	6fa4e5f7a546f21c5cbf518a117438bc33f941252a583a79fa730a74f849a035.exe	29
PID 1392 wrote to memory of 1536	1392	6fa4e5f7a546f21c5cbf518a117438bc33f941252a583a79fa730a74f849a035.exe	29
PID 1392 wrote to memory of 1536	1392	6fa4e5f7a546f21c5cbf518a117438bc33f941252a583a79fa730a74f849a035.exe	29

C:\Users\Admin\AppData\Local\Temp\6fa4e5f7a546f21c5cbf518a117438bc33f941252a583a79fa730a74f849a035.exe
"C:\Users\Admin\AppData\Local\Temp\6fa4e5f7a546f21c5cbf518a117438bc33f941252a583a79fa730a74f849a035.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6FA4E5~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1536

C:\Windows\nyrtuc.exe
C:\Windows\nyrtuc.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\nyrtuc.exe

Filesize
24KB

MD5
6b8fa20f8a6181244f532be85ef8e057

SHA1
6e00fdce8071b92864ea6b8762129055f6a1f8e5

SHA256
6fa4e5f7a546f21c5cbf518a117438bc33f941252a583a79fa730a74f849a035

SHA512
e7b4e6ee8952e4b09afdd59c680b84dbd4deb03e7f16e61d212a74cfa0ce7bd47ab977b3e7cb95ecb00eb96aec5ccf3c1772562db1ee3e952dbafc9330f8d226

Download Submit
C:\Windows\nyrtuc.exe

Filesize
24KB

MD5
6b8fa20f8a6181244f532be85ef8e057

SHA1
6e00fdce8071b92864ea6b8762129055f6a1f8e5

SHA256
6fa4e5f7a546f21c5cbf518a117438bc33f941252a583a79fa730a74f849a035

SHA512
e7b4e6ee8952e4b09afdd59c680b84dbd4deb03e7f16e61d212a74cfa0ce7bd47ab977b3e7cb95ecb00eb96aec5ccf3c1772562db1ee3e952dbafc9330f8d226

Download Submit
\Windows\SysWOW64\hra33.dll

Filesize
13KB

MD5
4430fbba045d29acfbc68a9498488155

SHA1
0607f402d13b14bf0f3ea8a832717df0cfe9c4b1

SHA256
86add6b9502bd128301972bcfddd47fb015a938ed92c0a72cef3698f904f0559

SHA512
ea5e7eadd4702dc77033c7540a7dc0e18c601edef8b257b034cb4bfc9de0f785d80b7bf934a82f8b8a9c16f91cdf22ce4e92611317ac56a70db06bb02722fc5b

Download Submit
memory/1392-54-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download
memory/1392-58-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1968-59-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1968-62-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download