9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d

General

Target

9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Size

1.1MB
MD5

73d04071d1fe9d513af10810faae59fa
SHA1

5b2192ce462273910cab044e46fd72bc0c01d294
SHA256

9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d
SHA512

ad4cec729219360b1643da387c845e02a281123748382385dfcc9b400c7004df031bc65e5d77e327d9d544a827de17aa5b2857757cb6ceba915113cd3d076318
SSDEEP

12288:ghkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aU05+TPpaL2iT:oRmJkcoQricOIQxiZY1iaU05cRaLP

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4704-133-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/memory/4704-135-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/memory/4704-136-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/memory/4704-137-0x0000000000400000-0x000000000044C000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ODBC Policies = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe\""	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ODBC Policies = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe\""	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe

Checks for any installed AV software in registry 1 TTPs 2 IoCs

Security Software Discovery

T1063

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\avast! Antivirus	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
4704	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
4704	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
4704	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
4704	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1152 set thread context of 4704	1152	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe

Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\CLSID\{302933E5-B4D7-2F4C-B64F-60E1F1FF46FD}\0DF402B2\CG1\GLA = 01000000	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\CLSID\{302933E5-B4D7-2F4C-B64F-60E1F1FF46FD}\0DF402B2\CS1	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\CLSID	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\CLSID\{302933E5-B4D7-2F4C-B64F-60E1F1FF46FD}	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\CLSID\{302933E5-B4D7-2F4C-B64F-60E1F1FF46FD}\0DF402B2	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\CLSID\{302933E5-B4D7-2F4C-B64F-60E1F1FF46FD}\0DF402B2\CW1	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\CLSID\{302933E5-B4D7-2F4C-B64F-60E1F1FF46FD}\0DF402B2\CW1\4704 = 01000000880f0000dc92420050000c00	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\CLSID\{302933E5-B4D7-2F4C-B64F-60E1F1FF46FD}\0DF402B2\CG1	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 4704	1152	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe	83
PID 1152 wrote to memory of 4704	1152	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe	83
PID 1152 wrote to memory of 4704	1152	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe	83
PID 1152 wrote to memory of 4704	1152	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe	83
PID 1152 wrote to memory of 4704	1152	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe	83
PID 1152 wrote to memory of 4704	1152	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe	83
PID 1152 wrote to memory of 4704	1152	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe	83
PID 1152 wrote to memory of 4704	1152	9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe	83

C:\Users\Admin\AppData\Local\Temp\9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
"C:\Users\Admin\AppData\Local\Temp\9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Local\Temp\9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe
  "C:\Users\Admin\AppData\Local\Temp\9111db631ada1c3432113a717f8252f81ddf3331f5a9f80cb3a2eeae2876058d.exe"
  2⤵
  - Adds Run key to start application
  - Checks for any installed AV software in registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks processor information in registry
  - Modifies Internet Explorer Protected Mode
  - Modifies registry class
  PID:4704

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

Security Software Discovery

1

T1063

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4704-133-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4704-135-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4704-136-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4704-137-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads