d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2

General

Target

d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe
Size

99KB
MD5

fb0ff061283be69f0081e1ac374af7b9
SHA1

7ef1d970ac7b38823bcfe205de1ca4fb3e88018e
SHA256

d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2
SHA512

87c3198e95e7c106b91e06b666f19b8bdf6fde8b78302408590a2c0a3b618070adb40fd71f3b45c723125e022a3699ca9a490c18e88921d5c0f02fe73398dd02
SSDEEP

768:3iD+bdPmJjRNjk3emu4v/eA5aiua4z7VP7LdGSu2HyTAzfMgTAzfM0CAXQzj2fSe:3iDgdUjl54vbQh+

Score

8^/10

upx

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	svchost.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4832-136-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4832-138-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4832-139-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4832-142-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4832-146-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4832-147-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3776 set thread context of 4832	3776	d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
4288	ipconfig.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3776	d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe
4832	svchost.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3776 wrote to memory of 4832	3776	d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe	81
PID 3776 wrote to memory of 4832	3776	d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe	81
PID 3776 wrote to memory of 4832	3776	d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe	81
PID 3776 wrote to memory of 4832	3776	d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe	81
PID 3776 wrote to memory of 4832	3776	d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe	81
PID 3776 wrote to memory of 4832	3776	d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe	81
PID 3776 wrote to memory of 4832	3776	d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe	81
PID 3776 wrote to memory of 4832	3776	d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe	81
PID 4832 wrote to memory of 4288	4832	svchost.exe	82
PID 4832 wrote to memory of 4288	4832	svchost.exe	82
PID 4832 wrote to memory of 4288	4832	svchost.exe	82
PID 3776 wrote to memory of 432	3776	d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe	84
PID 3776 wrote to memory of 432	3776	d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe	84
PID 3776 wrote to memory of 432	3776	d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe	84

C:\Users\Admin\AppData\Local\Temp\d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe
"C:\Users\Admin\AppData\Local\Temp\d68115ccebd3c33cad444ff3df830435acffd7b82818275eb9382e9e7b34b6e2.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  - Drops file in Drivers directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\SysWOW64\ipconfig.exe
    "C:\Windows\system32\ipconfig.exe" /flushdns
    3⤵
    - Gathers network information
    PID:4288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4.bat" "
  2⤵
  PID:432

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4.bat

Filesize
176B

MD5
58483f7f3b514bcb6765c45c8d8472d4

SHA1
53393168a46001a5898dc9f6eedb72a1e7b0a2c5

SHA256
048c9a68fc74c8ce4d276881eac26107dabae7ee4c6bf12e8de0c3ff80cc96e9

SHA512
083139f49c5333dfbcf6cdb47a00cf6f80ce476a0814df204a5d8c655c27e9ddcb2514daa685f14a3004f19cde55cbfb0bcde66d3c2c30b62f96c52c890e0f0d

Download Submit
memory/3776-132-0x0000000000401000-0x0000000000405000-memory.dmp

Filesize
16KB

Download
memory/4832-136-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4832-138-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4832-139-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4832-142-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4832-146-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4832-147-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads