956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606

General

Target

956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606.exe
Size

123KB
MD5

4cea91ed1eb846b18aa88c3579c11340
SHA1

314d845a38f106fc3fbc08c5c0738f3442796de4
SHA256

956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606
SHA512

54605bf5c02879fe5a10970c1d05a56e92b291efcba64adaa1bd57d2643b27f5d08b5d8320cedcd40e122bc41f6514505cfcaa0502e385c57c52ee971d1089ee
SSDEEP

3072:0NO2i7982jeR8ex85R16DyHwwlOKSsu2ijub/vgX:pB82E8F6DPsOKSl2ijAgX

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1120	4u.scr

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1448-61-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/1448-64-0x0000000000400000-0x0000000000424000-memory.dmp	upx

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Jafar.lnk	956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606.exe

Loads dropped DLL 2 IoCs

pid	Process
1448	956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606.exe
1448	956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\jafar\readme.txt	956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606.exe
File created	C:\Program Files (x86)\jafar\4u.scr	956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606.exe
File opened for modification	C:\Program Files (x86)\jafar\4u.scr	956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606.exe
File opened for modification	C:\Program Files (x86)\jafar\vir.bat	956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606.exe
File opened for modification	C:\Program Files (x86)\jafar\start.BAT	956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606.exe
File created	C:\Program Files (x86)\jafar\777.COM	956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606.exe
File created	C:\Program Files (x86)\jafar\readme.txt	956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606.exe
File created	C:\Program Files (x86)\jafar\vir.bat	956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606.exe
File created	C:\Program Files (x86)\jafar\vir.EXE	956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606.exe
File opened for modification	C:\Program Files (x86)\jafar\vir.EXE	956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606.exe
File opened for modification	C:\Program Files (x86)\jafar	956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606.exe
File created	C:\Program Files (x86)\jafar\start.BAT	956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606.exe
File opened for modification	C:\Program Files (x86)\jafar\777.COM	956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\matrixcode_fs.log	4u.scr
File opened for modification	C:\Windows\matrixcode_fs.log	4u.scr

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	1448	956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606.exe
Token: SeBackupPrivilege	1448	956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606.exe
Token: SeRestorePrivilege	1120	4u.scr
Token: SeBackupPrivilege	1120	4u.scr

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1120	1448	956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606.exe	27
PID 1448 wrote to memory of 1120	1448	956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606.exe	27
PID 1448 wrote to memory of 1120	1448	956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606.exe	27
PID 1448 wrote to memory of 1120	1448	956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606.exe	27
PID 1448 wrote to memory of 1120	1448	956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606.exe	27
PID 1448 wrote to memory of 1120	1448	956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606.exe	27
PID 1448 wrote to memory of 1120	1448	956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606.exe	27

C:\Users\Admin\AppData\Local\Temp\956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606.exe
"C:\Users\Admin\AppData\Local\Temp\956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Program Files (x86)\jafar\4u.scr
  "C:\Program Files (x86)\jafar\4u.scr" /S
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:1120

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\jafar\4u.scr

Filesize
136KB

MD5
f70d5908eed26d11709cee0ac0de636f

SHA1
db7f684ce3b4e0c4090a1e1f04145206eed11cab

SHA256
300291c4ac26ce1eebe549123a965326763a0d98d4fef08e3f5fb0ba11459b40

SHA512
b2584c6ad760db5f539da0f74d0bfb2708a6785ae559c7ee8d9277d293826ab9d7adc5f7a49e10c9a0b42ae580b51b0992a6470326e09df057e0108a81b2dee9

Download Submit
C:\Program Files (x86)\jafar\4u.scr

Filesize
136KB

MD5
f70d5908eed26d11709cee0ac0de636f

SHA1
db7f684ce3b4e0c4090a1e1f04145206eed11cab

SHA256
300291c4ac26ce1eebe549123a965326763a0d98d4fef08e3f5fb0ba11459b40

SHA512
b2584c6ad760db5f539da0f74d0bfb2708a6785ae559c7ee8d9277d293826ab9d7adc5f7a49e10c9a0b42ae580b51b0992a6470326e09df057e0108a81b2dee9

Download Submit
\Program Files (x86)\jafar\4u.scr

Filesize
136KB

MD5
f70d5908eed26d11709cee0ac0de636f

SHA1
db7f684ce3b4e0c4090a1e1f04145206eed11cab

SHA256
300291c4ac26ce1eebe549123a965326763a0d98d4fef08e3f5fb0ba11459b40

SHA512
b2584c6ad760db5f539da0f74d0bfb2708a6785ae559c7ee8d9277d293826ab9d7adc5f7a49e10c9a0b42ae580b51b0992a6470326e09df057e0108a81b2dee9

Download Submit
\Program Files (x86)\jafar\4u.scr

Filesize
136KB

MD5
f70d5908eed26d11709cee0ac0de636f

SHA1
db7f684ce3b4e0c4090a1e1f04145206eed11cab

SHA256
300291c4ac26ce1eebe549123a965326763a0d98d4fef08e3f5fb0ba11459b40

SHA512
b2584c6ad760db5f539da0f74d0bfb2708a6785ae559c7ee8d9277d293826ab9d7adc5f7a49e10c9a0b42ae580b51b0992a6470326e09df057e0108a81b2dee9

Download Submit
memory/1448-54-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download
memory/1448-61-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1448-62-0x0000000000240000-0x0000000000264000-memory.dmp

Filesize
144KB

Download
memory/1448-63-0x0000000000240000-0x0000000000264000-memory.dmp

Filesize
144KB

Download
memory/1448-64-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1448-65-0x0000000000240000-0x000000000024D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing