d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2

General

Target

d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe
Size

99KB
MD5

fb0ff061283be69f0081e1ac374af7b9
SHA1

7ef1d970ac7b38823bcfe205de1ca4fb3e88018e
SHA256

d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2
SHA512

87c3198e95e7c106b91e06b666f19b8bdf6fde8b78302408590a2c0a3b618070adb40fd71f3b45c723125e022a3699ca9a490c18e88921d5c0f02fe73398dd02
SSDEEP

768:3iD+bdPmJjRNjk3emu4v/eA5aiua4z7VP7LdGSu2HyTAzfMgTAzfM0CAXQzj2fSe:3iDgdUjl54vbQh+

Score

8^/10

upx

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	svchost.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/684-58-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/684-59-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/684-60-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/684-64-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/684-65-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/684-70-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/684-74-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/684-75-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1280	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 868 set thread context of 684	868	d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
872	ipconfig.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
868	d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe
684	svchost.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 684	868	d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe	28
PID 868 wrote to memory of 684	868	d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe	28
PID 868 wrote to memory of 684	868	d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe	28
PID 868 wrote to memory of 684	868	d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe	28
PID 868 wrote to memory of 684	868	d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe	28
PID 868 wrote to memory of 684	868	d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe	28
PID 868 wrote to memory of 684	868	d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe	28
PID 868 wrote to memory of 684	868	d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe	28
PID 868 wrote to memory of 1280	868	d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe	29
PID 868 wrote to memory of 1280	868	d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe	29
PID 868 wrote to memory of 1280	868	d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe	29
PID 868 wrote to memory of 1280	868	d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe	29
PID 684 wrote to memory of 872	684	svchost.exe	31
PID 684 wrote to memory of 872	684	svchost.exe	31
PID 684 wrote to memory of 872	684	svchost.exe	31
PID 684 wrote to memory of 872	684	svchost.exe	31

C:\Users\Admin\AppData\Local\Temp\d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe
"C:\Users\Admin\AppData\Local\Temp\d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  - Drops file in Drivers directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:684
- - C:\Windows\SysWOW64\ipconfig.exe
    "C:\Windows\system32\ipconfig.exe" /flushdns
    3⤵
    - Gathers network information
    PID:872
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\4.bat" "
  2⤵
  - Deletes itself
  PID:1280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4.bat

Filesize
176B

MD5
58483f7f3b514bcb6765c45c8d8472d4

SHA1
53393168a46001a5898dc9f6eedb72a1e7b0a2c5

SHA256
048c9a68fc74c8ce4d276881eac26107dabae7ee4c6bf12e8de0c3ff80cc96e9

SHA512
083139f49c5333dfbcf6cdb47a00cf6f80ce476a0814df204a5d8c655c27e9ddcb2514daa685f14a3004f19cde55cbfb0bcde66d3c2c30b62f96c52c890e0f0d

Download Submit
memory/684-64-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/684-65-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/684-59-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/684-60-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/684-75-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/684-74-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/684-58-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/684-57-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/684-70-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/868-63-0x0000000075D11000-0x0000000075D13000-memory.dmp

Filesize
8KB

Download
memory/868-54-0x0000000000401000-0x0000000000405000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing