d878eec2d55a3d5e1ff2667a7464ebc5bbf06d33de345a1032e9f0df0bb416ad

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 05:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d878eec2d55a3d5e1ff2667a7464ebc5bbf06d33de345a1032e9f0df0bb416ad.exe
Size

473KB
MD5

8eaf1da27c17d83decb6bc764f358874
SHA1

8ffacbd4718f720f81ab4eeda9a3b0673ae7f9df
SHA256

d878eec2d55a3d5e1ff2667a7464ebc5bbf06d33de345a1032e9f0df0bb416ad
SHA512

cac3e01f817813e06c50b33b29c5cd043ddee9f2ad7322ebed559382b069d9ad25b2ae4f722968a092286bc3d9c6e3542af0ec964d181d6be093dda231d7b91d
SSDEEP

12288:EHLUMuiv9RgfSjAzRtyA7LquA/UvwmNoQG:etAR7BGUvU

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	d878eec2d55a3d5e1ff2667a7464ebc5bbf06d33de345a1032e9f0df0bb416ad.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	d878eec2d55a3d5e1ff2667a7464ebc5bbf06d33de345a1032e9f0df0bb416ad.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	d878eec2d55a3d5e1ff2667a7464ebc5bbf06d33de345a1032e9f0df0bb416ad.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\d878eec2d55a3d5e1ff2667a7464ebc5bbf06d33de345a1032e9f0df0bb416ad.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d878eec2d55a3d5e1ff2667a7464ebc5bbf06d33de345a1032e9f0df0bb416ad.exe:*:Enabled:Windows Time Synchronization"	d878eec2d55a3d5e1ff2667a7464ebc5bbf06d33de345a1032e9f0df0bb416ad.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4692-132-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/4692-133-0x0000000000400000-0x00000000004B8000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Syncro = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d878eec2d55a3d5e1ff2667a7464ebc5bbf06d33de345a1032e9f0df0bb416ad.exe"	d878eec2d55a3d5e1ff2667a7464ebc5bbf06d33de345a1032e9f0df0bb416ad.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	d878eec2d55a3d5e1ff2667a7464ebc5bbf06d33de345a1032e9f0df0bb416ad.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/4692-133-0x0000000000400000-0x00000000004B8000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4692	d878eec2d55a3d5e1ff2667a7464ebc5bbf06d33de345a1032e9f0df0bb416ad.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4692	d878eec2d55a3d5e1ff2667a7464ebc5bbf06d33de345a1032e9f0df0bb416ad.exe
4692	d878eec2d55a3d5e1ff2667a7464ebc5bbf06d33de345a1032e9f0df0bb416ad.exe

C:\Users\Admin\AppData\Local\Temp\d878eec2d55a3d5e1ff2667a7464ebc5bbf06d33de345a1032e9f0df0bb416ad.exe
"C:\Users\Admin\AppData\Local\Temp\d878eec2d55a3d5e1ff2667a7464ebc5bbf06d33de345a1032e9f0df0bb416ad.exe"
1⤵
- Modifies firewall policy service
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4692-132-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/4692-133-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads