85a50a7d792ba58e4bfddc2f7eeb2145eca8fa2192b5131b7615f2cb7dc22641

General

Target

85a50a7d792ba58e4bfddc2f7eeb2145eca8fa2192b5131b7615f2cb7dc22641.exe
Size

9.6MB
MD5

b0c31cb0a459715e7549b18f17ff035d
SHA1

e6ffc55c605f09034430a6b93c9373857af53051
SHA256

85a50a7d792ba58e4bfddc2f7eeb2145eca8fa2192b5131b7615f2cb7dc22641
SHA512

31f54fab45b87e4208243590ea2ab901dd298c2af4ac26bc76813b837830699db7053b46d90eb63841aaca3a2c56b7bbf570b38b6099da60d858a155efb2934c
SSDEEP

98304:BpXzR1uS2cHplAELLJBAUZLaAf/NOIduJN2sZ+fEJBAUZLbvL8:VX3JVWyFOIIJCfEJVvvL8

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5048-133-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/5048-136-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/5048-135-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/5048-138-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/5048-137-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/5048-140-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/5048-142-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/5048-144-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/5048-146-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/5048-152-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/5048-154-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/5048-150-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/5048-148-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/5048-156-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/5048-160-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/5048-158-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/5048-162-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/5048-164-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/5048-166-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/5048-168-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/5048-170-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/5048-172-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/5048-174-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/5048-176-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/5048-178-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/5048-179-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/5048-180-0x0000000010000000-0x000000001003D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5048	85a50a7d792ba58e4bfddc2f7eeb2145eca8fa2192b5131b7615f2cb7dc22641.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5048	85a50a7d792ba58e4bfddc2f7eeb2145eca8fa2192b5131b7615f2cb7dc22641.exe
5048	85a50a7d792ba58e4bfddc2f7eeb2145eca8fa2192b5131b7615f2cb7dc22641.exe
5048	85a50a7d792ba58e4bfddc2f7eeb2145eca8fa2192b5131b7615f2cb7dc22641.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 2480	5048	85a50a7d792ba58e4bfddc2f7eeb2145eca8fa2192b5131b7615f2cb7dc22641.exe	89
PID 5048 wrote to memory of 2480	5048	85a50a7d792ba58e4bfddc2f7eeb2145eca8fa2192b5131b7615f2cb7dc22641.exe	89
PID 2480 wrote to memory of 3244	2480	msedge.exe	90
PID 2480 wrote to memory of 3244	2480	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\85a50a7d792ba58e4bfddc2f7eeb2145eca8fa2192b5131b7615f2cb7dc22641.exe
"C:\Users\Admin\AppData\Local\Temp\85a50a7d792ba58e4bfddc2f7eeb2145eca8fa2192b5131b7615f2cb7dc22641.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.uc886.com/shikong.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff81c3846f8,0x7ff81c384708,0x7ff81c384718
    3⤵
    PID:3244

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5048-160-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/5048-180-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/5048-137-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/5048-140-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/5048-142-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/5048-144-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/5048-146-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/5048-152-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/5048-154-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/5048-150-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/5048-148-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/5048-162-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/5048-138-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/5048-133-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/5048-156-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/5048-164-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/5048-166-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/5048-168-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/5048-170-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/5048-172-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/5048-174-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/5048-176-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/5048-178-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/5048-179-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/5048-158-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/5048-135-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/5048-136-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing