9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d

General

Target

9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Size

1.1MB
MD5

73d04071d1fe9d513af10810faae59fa
SHA1

5b2192ce462273910cab044e46fd72bc0c01d294
SHA256

9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d
SHA512

ad4cec729219360b1643da387c845e02a281123748382385dfcc9b400c7004df031bc65e5d77e327d9d544a827de17aa5b2857757cb6ceba915113cd3d076318
SSDEEP

12288:ghkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aU05+TPpaL2iT:oRmJkcoQricOIQxiZY1iaU05cRaLP

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/944-56-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral1/memory/944-58-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral1/memory/944-59-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral1/memory/944-62-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral1/memory/944-63-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral1/memory/944-65-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral1/memory/944-67-0x0000000000400000-0x000000000044C000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ODBC Policies = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe\""	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\ODBC Policies = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe\""	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe

Checks for any installed AV software in registry 1 TTPs 2 IoCs

Security Software Discovery

T1063

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\avast! Antivirus	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
944	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
944	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
944	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
944	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1216 set thread context of 944	1216	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe

Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\CLSID\{143A0C48-AD21-674F-B81C-047D6AE79E76}	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\CLSID\{143A0C48-AD21-674F-B81C-047D6AE79E76}\0DF402B2	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\CLSID\{143A0C48-AD21-674F-B81C-047D6AE79E76}\0DF402B2\CW1	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\CLSID\{143A0C48-AD21-674F-B81C-047D6AE79E76}\0DF402B2\CW1\944 = 0100000098030000dc92420016000700	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\CLSID\{143A0C48-AD21-674F-B81C-047D6AE79E76}\0DF402B2\CG1	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\CLSID\{143A0C48-AD21-674F-B81C-047D6AE79E76}\0DF402B2\CG1\GLA = 01000000	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\CLSID\{143A0C48-AD21-674F-B81C-047D6AE79E76}\0DF402B2\CS1	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\CLSID	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 944	1216	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe	28
PID 1216 wrote to memory of 944	1216	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe	28
PID 1216 wrote to memory of 944	1216	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe	28
PID 1216 wrote to memory of 944	1216	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe	28
PID 1216 wrote to memory of 944	1216	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe	28
PID 1216 wrote to memory of 944	1216	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe	28
PID 1216 wrote to memory of 944	1216	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe	28
PID 1216 wrote to memory of 944	1216	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe	28

C:\Users\Admin\AppData\Local\Temp\9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
"C:\Users\Admin\AppData\Local\Temp\9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Users\Admin\AppData\Local\Temp\9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
  "C:\Users\Admin\AppData\Local\Temp\9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe"
  2⤵
  - Adds Run key to start application
  - Checks for any installed AV software in registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks processor information in registry
  - Modifies Internet Explorer Protected Mode
  - Modifies registry class
  PID:944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

Security Software Discovery

1

T1063

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/944-55-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/944-56-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/944-58-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/944-59-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/944-62-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/944-63-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/944-65-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/944-66-0x0000000000230000-0x0000000000239000-memory.dmp

Filesize
36KB

Download
memory/944-67-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1216-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads