850611020495dfde1a5c2d9fe7bd71671583e790c38159dae841573940f9929c

General

Target

850611020495dfde1a5c2d9fe7bd71671583e790c38159dae841573940f9929c.exe
Size

338KB
MD5

372dd6436199ff3525774eca46c57107
SHA1

430847fc8275239980dab092595f20997186f77a
SHA256

850611020495dfde1a5c2d9fe7bd71671583e790c38159dae841573940f9929c
SHA512

93aa185c08f20a0fe9b51f98a28540a75741cf48053346f624e37724c65504f8b1288dabb92044ec64ac5f26a8c3375814ac14ed7dbd7f56d4525113e3b08455
SSDEEP

6144:S0tSEiBQ/sstejlmB1l9ml2AEMTmYz5Da4XclFtIbiFbTJDe9HPlRo/rdklCDS:S1qlLmYMTmGa4XclvAYlGnoxkw+

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1796	hdzjgqrmqj.exe

Deletes itself 1 IoCs

pid	Process
904	cmd.exe

Loads dropped DLL 3 IoCs

pid	Process
904	cmd.exe
904	cmd.exe
1796	hdzjgqrmqj.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	850611020495dfde1a5c2d9fe7bd71671583e790c38159dae841573940f9929c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
828	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1784	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	828	taskkill.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 904	1348	850611020495dfde1a5c2d9fe7bd71671583e790c38159dae841573940f9929c.exe	26
PID 1348 wrote to memory of 904	1348	850611020495dfde1a5c2d9fe7bd71671583e790c38159dae841573940f9929c.exe	26
PID 1348 wrote to memory of 904	1348	850611020495dfde1a5c2d9fe7bd71671583e790c38159dae841573940f9929c.exe	26
PID 1348 wrote to memory of 904	1348	850611020495dfde1a5c2d9fe7bd71671583e790c38159dae841573940f9929c.exe	26
PID 904 wrote to memory of 828	904	cmd.exe	28
PID 904 wrote to memory of 828	904	cmd.exe	28
PID 904 wrote to memory of 828	904	cmd.exe	28
PID 904 wrote to memory of 828	904	cmd.exe	28
PID 904 wrote to memory of 1784	904	cmd.exe	30
PID 904 wrote to memory of 1784	904	cmd.exe	30
PID 904 wrote to memory of 1784	904	cmd.exe	30
PID 904 wrote to memory of 1784	904	cmd.exe	30
PID 904 wrote to memory of 1796	904	cmd.exe	31
PID 904 wrote to memory of 1796	904	cmd.exe	31
PID 904 wrote to memory of 1796	904	cmd.exe	31
PID 904 wrote to memory of 1796	904	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\850611020495dfde1a5c2d9fe7bd71671583e790c38159dae841573940f9929c.exe
"C:\Users\Admin\AppData\Local\Temp\850611020495dfde1a5c2d9fe7bd71671583e790c38159dae841573940f9929c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /f /pid 1348 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\850611020495dfde1a5c2d9fe7bd71671583e790c38159dae841573940f9929c.exe" & start C:\Users\Admin\AppData\Local\HDZJGQ~1.EXE -f
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /pid 1348
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:828
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.1
    3⤵
    - Runs ping.exe
    PID:1784
- - C:\Users\Admin\AppData\Local\hdzjgqrmqj.exe
    C:\Users\Admin\AppData\Local\HDZJGQ~1.EXE -f
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1796

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\hdzjgqrmqj.exe

Filesize
338KB

MD5
372dd6436199ff3525774eca46c57107

SHA1
430847fc8275239980dab092595f20997186f77a

SHA256
850611020495dfde1a5c2d9fe7bd71671583e790c38159dae841573940f9929c

SHA512
93aa185c08f20a0fe9b51f98a28540a75741cf48053346f624e37724c65504f8b1288dabb92044ec64ac5f26a8c3375814ac14ed7dbd7f56d4525113e3b08455

Download Submit
C:\Users\Admin\AppData\Local\hdzjgqrmqj.exe

Filesize
338KB

MD5
372dd6436199ff3525774eca46c57107

SHA1
430847fc8275239980dab092595f20997186f77a

SHA256
850611020495dfde1a5c2d9fe7bd71671583e790c38159dae841573940f9929c

SHA512
93aa185c08f20a0fe9b51f98a28540a75741cf48053346f624e37724c65504f8b1288dabb92044ec64ac5f26a8c3375814ac14ed7dbd7f56d4525113e3b08455

Download Submit
\Users\Admin\AppData\Local\hdzjgqrmqj.exe

Filesize
338KB

MD5
372dd6436199ff3525774eca46c57107

SHA1
430847fc8275239980dab092595f20997186f77a

SHA256
850611020495dfde1a5c2d9fe7bd71671583e790c38159dae841573940f9929c

SHA512
93aa185c08f20a0fe9b51f98a28540a75741cf48053346f624e37724c65504f8b1288dabb92044ec64ac5f26a8c3375814ac14ed7dbd7f56d4525113e3b08455

Download Submit
\Users\Admin\AppData\Local\hdzjgqrmqj.exe

Filesize
338KB

MD5
372dd6436199ff3525774eca46c57107

SHA1
430847fc8275239980dab092595f20997186f77a

SHA256
850611020495dfde1a5c2d9fe7bd71671583e790c38159dae841573940f9929c

SHA512
93aa185c08f20a0fe9b51f98a28540a75741cf48053346f624e37724c65504f8b1288dabb92044ec64ac5f26a8c3375814ac14ed7dbd7f56d4525113e3b08455

Download Submit
\Users\Admin\AppData\Local\hdzjgqrmqj.exe

Filesize
338KB

MD5
372dd6436199ff3525774eca46c57107

SHA1
430847fc8275239980dab092595f20997186f77a

SHA256
850611020495dfde1a5c2d9fe7bd71671583e790c38159dae841573940f9929c

SHA512
93aa185c08f20a0fe9b51f98a28540a75741cf48053346f624e37724c65504f8b1288dabb92044ec64ac5f26a8c3375814ac14ed7dbd7f56d4525113e3b08455

Download Submit
memory/1348-58-0x0000000001000000-0x00000000010A7000-memory.dmp

Filesize
668KB

Download
memory/1348-54-0x0000000001000000-0x00000000010A7000-memory.dmp

Filesize
668KB

Download
memory/1348-56-0x0000000001000000-0x00000000010A7000-memory.dmp

Filesize
668KB

Download
memory/1348-55-0x00000000750A1000-0x00000000750A3000-memory.dmp

Filesize
8KB

Download
memory/1796-69-0x0000000001000000-0x00000000010A7000-memory.dmp

Filesize
668KB

Download
memory/1796-70-0x0000000001000000-0x00000000010A7000-memory.dmp

Filesize
668KB

Download

Analysis

Sharing