692c19600eea6780871ff14efd422558d5493a2ddf435a7433fc2d0bda23d1cd

General

Target

692c19600eea6780871ff14efd422558d5493a2ddf435a7433fc2d0bda23d1cd.exe
Size

1.4MB
MD5

f5aa29925130f2f8176431ac481e896c
SHA1

6718884acd2b6d1a6a19b3ab8568b863b8b17efa
SHA256

692c19600eea6780871ff14efd422558d5493a2ddf435a7433fc2d0bda23d1cd
SHA512

52583336f3225b686cd4f701110f04e08689feab2e152c704ec589c947f937b98f5b34f90b4564b1106370874abcfbd823d603b68f2cca8e5934c2a4b55d0fb7
SSDEEP

24576:fitV0IsFKeOMMM5ge8sfqJDWw0CXryLtmx5kvJDDmZg1uXmTiG069fK+ay25LUmR:fitV1YKeOMMM58sfsDrtyLtBJ2ZLXmTU

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

~GM6421.exe

pid process

2044 ~GM6421.exe

pid	process
2044	~GM6421.exe

UPX packed file 33 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\~GM6421.exe	upx
\Users\Admin\AppData\Local\Temp\~GM6421.exe	upx
C:\Users\Admin\AppData\Local\Temp\~GM6421.exe	upx
behavioral1/memory/2044-61-0x0000000000400000-0x00000000005E3000-memory.dmp	upx
behavioral1/memory/2044-62-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2044-65-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2044-64-0x0000000010000000-0x000000001003D000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\~GM6421.exe	upx
behavioral1/memory/2044-72-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2044-70-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2044-68-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2044-67-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2044-74-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2044-76-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2044-78-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2044-80-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2044-82-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2044-84-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2044-86-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2044-88-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2044-90-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2044-92-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2044-94-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2044-96-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2044-98-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2044-100-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2044-102-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2044-104-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2044-106-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2044-108-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2044-109-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2044-110-0x0000000000400000-0x00000000005E3000-memory.dmp	upx
behavioral1/memory/2044-111-0x0000000010000000-0x000000001003D000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

692c19600eea6780871ff14efd422558d5493a2ddf435a7433fc2d0bda23d1cd.exe

pid	process
536	692c19600eea6780871ff14efd422558d5493a2ddf435a7433fc2d0bda23d1cd.exe
536	692c19600eea6780871ff14efd422558d5493a2ddf435a7433fc2d0bda23d1cd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

~GM6421.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	~GM6421.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	~GM6421.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	~GM6421.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

692c19600eea6780871ff14efd422558d5493a2ddf435a7433fc2d0bda23d1cd.exe

description pid process

Token: SeDebugPrivilege 536 692c19600eea6780871ff14efd422558d5493a2ddf435a7433fc2d0bda23d1cd.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

~GM6421.exe

pid process

2044 ~GM6421.exe
2044 ~GM6421.exe
2044 ~GM6421.exe
2044 ~GM6421.exe
2044 ~GM6421.exe

description	pid	process
Token: SeDebugPrivilege	536	692c19600eea6780871ff14efd422558d5493a2ddf435a7433fc2d0bda23d1cd.exe

pid	process
2044	~GM6421.exe
2044	~GM6421.exe
2044	~GM6421.exe
2044	~GM6421.exe
2044	~GM6421.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

692c19600eea6780871ff14efd422558d5493a2ddf435a7433fc2d0bda23d1cd.exe

description	pid	process	target process
PID 536 wrote to memory of 2044	536	692c19600eea6780871ff14efd422558d5493a2ddf435a7433fc2d0bda23d1cd.exe	~GM6421.exe
PID 536 wrote to memory of 2044	536	692c19600eea6780871ff14efd422558d5493a2ddf435a7433fc2d0bda23d1cd.exe	~GM6421.exe
PID 536 wrote to memory of 2044	536	692c19600eea6780871ff14efd422558d5493a2ddf435a7433fc2d0bda23d1cd.exe	~GM6421.exe
PID 536 wrote to memory of 2044	536	692c19600eea6780871ff14efd422558d5493a2ddf435a7433fc2d0bda23d1cd.exe	~GM6421.exe

C:\Users\Admin\AppData\Local\Temp\692c19600eea6780871ff14efd422558d5493a2ddf435a7433fc2d0bda23d1cd.exe
"C:\Users\Admin\AppData\Local\Temp\692c19600eea6780871ff14efd422558d5493a2ddf435a7433fc2d0bda23d1cd.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:536

C:\Users\Admin\AppData\Local\Temp\~GM6421.exe
"C:\Users\Admin\AppData\Local\Temp\~GM6421.exe"
2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2044

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~GM6421.exe
Filesize
1.1MB

MD5
55dac6b4a708ec613fff6a69f1871be2

SHA1
d029cc81e652a4e86d4052be3d13b496337d66ce

SHA256
9b23fbd66fbfc71705383c2e75ba1eb1ed6af881d4d554dbcf2d2c3cea11ff16

SHA512
58e74c7e43e9e5710f6203a4335e6c509cc9cf11e0630be6442c5edce0885151e88844315c9e7e0debf04a143f570ff8401cefe29aeefabd66c41676a40dacfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\~GM6421.exe
Filesize
1.1MB

MD5
55dac6b4a708ec613fff6a69f1871be2

SHA1
d029cc81e652a4e86d4052be3d13b496337d66ce

SHA256
9b23fbd66fbfc71705383c2e75ba1eb1ed6af881d4d554dbcf2d2c3cea11ff16

SHA512
58e74c7e43e9e5710f6203a4335e6c509cc9cf11e0630be6442c5edce0885151e88844315c9e7e0debf04a143f570ff8401cefe29aeefabd66c41676a40dacfd

Download Submit
\Users\Admin\AppData\Local\Temp\~GM6421.exe
Filesize
1.1MB

MD5
55dac6b4a708ec613fff6a69f1871be2

SHA1
d029cc81e652a4e86d4052be3d13b496337d66ce

SHA256
9b23fbd66fbfc71705383c2e75ba1eb1ed6af881d4d554dbcf2d2c3cea11ff16

SHA512
58e74c7e43e9e5710f6203a4335e6c509cc9cf11e0630be6442c5edce0885151e88844315c9e7e0debf04a143f570ff8401cefe29aeefabd66c41676a40dacfd

Download Submit
\Users\Admin\AppData\Local\Temp\~GM6421.exe
Filesize
1.1MB

MD5
55dac6b4a708ec613fff6a69f1871be2

SHA1
d029cc81e652a4e86d4052be3d13b496337d66ce

SHA256
9b23fbd66fbfc71705383c2e75ba1eb1ed6af881d4d554dbcf2d2c3cea11ff16

SHA512
58e74c7e43e9e5710f6203a4335e6c509cc9cf11e0630be6442c5edce0885151e88844315c9e7e0debf04a143f570ff8401cefe29aeefabd66c41676a40dacfd

Download Submit
memory/536-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/536-60-0x0000000000D00000-0x0000000000EE3000-memory.dmp

Filesize
1.9MB

Download
memory/2044-80-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2044-86-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2044-65-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2044-64-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2044-61-0x0000000000400000-0x00000000005E3000-memory.dmp

Filesize
1.9MB

Download
memory/2044-72-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2044-70-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2044-68-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2044-67-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2044-74-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2044-76-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2044-78-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2044-57-0x0000000000000000-mapping.dmp

Download
memory/2044-82-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2044-84-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2044-62-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2044-88-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2044-90-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2044-92-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2044-94-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2044-96-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2044-98-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2044-100-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2044-102-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2044-104-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2044-106-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2044-108-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2044-109-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2044-110-0x0000000000400000-0x00000000005E3000-memory.dmp

Filesize
1.9MB

Download
memory/2044-111-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads