5448955815779876e98583d1accbd0cb8a6f525906c05d7bd828114cdf870193

General

Target

INV#001.exe
Size

300.0MB
MD5

79a721193aea183da48ebce3f397bcef
SHA1

3315518cf5be28cc5d6399f984308d9b276089cc
SHA256

5448955815779876e98583d1accbd0cb8a6f525906c05d7bd828114cdf870193
SHA512

21f688290c108da832a1480175958f55f22fa03efa212423fd33f0e389e82071ab6a3d046528c210babc83b400cf17fd90d9244abafbc496bc321d66d0b9804c
SSDEEP

6291456:SN889w7Nc2HK90Lxg4xMszaG3E0sR2eUAdBGU+yy/JsQA/qC:SN889Bg00Lu4xMgaGUxRZpdBGayR/oq

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

INV#001.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hifikjoa = "\"C:\\Users\\Admin\\AppData\\Roaming\\Xyzffyjzjsk\\Hifikjoa.exe\""	INV#001.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

powershell.exeINV#001.exe

pid	process
960	powershell.exe
1488	INV#001.exe
1488	INV#001.exe
1488	INV#001.exe
1488	INV#001.exe
1488	INV#001.exe
1488	INV#001.exe
1488	INV#001.exe
1488	INV#001.exe
1488	INV#001.exe
1488	INV#001.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

INV#001.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1488 INV#001.exe
Token: SeDebugPrivilege 960 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1488	INV#001.exe
Token: SeDebugPrivilege	960	powershell.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

INV#001.exe

description	pid	process	target process
PID 1488 wrote to memory of 960	1488	INV#001.exe	powershell.exe
PID 1488 wrote to memory of 960	1488	INV#001.exe	powershell.exe
PID 1488 wrote to memory of 960	1488	INV#001.exe	powershell.exe
PID 1488 wrote to memory of 960	1488	INV#001.exe	powershell.exe
PID 1488 wrote to memory of 2012	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 2012	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 2012	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 2012	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 1552	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 1552	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 1552	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 1552	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 1764	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 1764	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 1764	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 1764	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 1280	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 1280	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 1280	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 1280	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 676	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 676	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 676	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 676	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 748	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 748	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 748	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 748	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 1800	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 1800	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 1800	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 1800	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 540	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 540	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 540	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 540	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 1876	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 1876	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 1876	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 1876	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 1252	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 1252	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 1252	1488	INV#001.exe	INV#001.exe
PID 1488 wrote to memory of 1252	1488	INV#001.exe	INV#001.exe

C:\Users\Admin\AppData\Local\Temp\INV#001.exe
"C:\Users\Admin\AppData\Local\Temp\INV#001.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:960
- C:\Users\Admin\AppData\Local\Temp\INV#001.exe
  C:\Users\Admin\AppData\Local\Temp\INV#001.exe
  2⤵
  PID:2012
- C:\Users\Admin\AppData\Local\Temp\INV#001.exe
  C:\Users\Admin\AppData\Local\Temp\INV#001.exe
  2⤵
  PID:1552
- C:\Users\Admin\AppData\Local\Temp\INV#001.exe
  C:\Users\Admin\AppData\Local\Temp\INV#001.exe
  2⤵
  PID:1764
- C:\Users\Admin\AppData\Local\Temp\INV#001.exe
  C:\Users\Admin\AppData\Local\Temp\INV#001.exe
  2⤵
  PID:1280
- C:\Users\Admin\AppData\Local\Temp\INV#001.exe
  C:\Users\Admin\AppData\Local\Temp\INV#001.exe
  2⤵
  PID:676
- C:\Users\Admin\AppData\Local\Temp\INV#001.exe
  C:\Users\Admin\AppData\Local\Temp\INV#001.exe
  2⤵
  PID:748
- C:\Users\Admin\AppData\Local\Temp\INV#001.exe
  C:\Users\Admin\AppData\Local\Temp\INV#001.exe
  2⤵
  PID:1800
- C:\Users\Admin\AppData\Local\Temp\INV#001.exe
  C:\Users\Admin\AppData\Local\Temp\INV#001.exe
  2⤵
  PID:540
- C:\Users\Admin\AppData\Local\Temp\INV#001.exe
  C:\Users\Admin\AppData\Local\Temp\INV#001.exe
  2⤵
  PID:1876
- C:\Users\Admin\AppData\Local\Temp\INV#001.exe
  C:\Users\Admin\AppData\Local\Temp\INV#001.exe
  2⤵
  PID:1252

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/960-57-0x0000000000000000-mapping.dmp

Download
memory/960-59-0x000000006F630000-0x000000006FBDB000-memory.dmp

Filesize
5.7MB

Download
memory/960-60-0x000000006F630000-0x000000006FBDB000-memory.dmp

Filesize
5.7MB

Download
memory/960-61-0x000000006F630000-0x000000006FBDB000-memory.dmp

Filesize
5.7MB

Download
memory/1488-54-0x0000000000310000-0x0000000001310000-memory.dmp

Filesize
16.0MB

Download
memory/1488-55-0x00000000760A1000-0x00000000760A3000-memory.dmp

Filesize
8KB

Download
memory/1488-56-0x00000000189C0000-0x0000000018BD6000-memory.dmp

Filesize
2.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads