3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af

General

Target

3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
Size

16.8MB
MD5

0ee4fb241171bccc49b242101ad50901
SHA1

a8b3e341d88a56ca73ce15aa3ddcebddfac29c09
SHA256

3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af
SHA512

10a54e85f38d976801ad9fa123c4dd8c044b54ec35f87b6463540eaf2e1a12976f85fd6c2e5c25b9b536982c20e1c9d2e21854db9e6a87a2ccce158efde8c305
SSDEEP

196608:mU7d9xZSt4U7d9xZStSU7d9xZSt4U7d9xZStmalLXx:n7d9xZo7d9xZS7d9xZo7d9xZ9alLX

Score

7^/10

persistence upx

Malware Config

Signatures

Drops startup file 1 IoCs

Processes:

cmd.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4764-134-0x0000000000400000-0x0000000000449000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe

description	pid	process	target process
PID 4764 set thread context of 4424	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4424 set thread context of 4608	4424	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe

pid	process
4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe

pid	process
4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
4608	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
4608	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe

C:\Users\Admin\AppData\Local\Temp\3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
"C:\Users\Admin\AppData\Local\Temp\3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4764

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
2⤵
- Drops startup file
PID:4420

C:\Users\Admin\AppData\Local\Temp\3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
C:\Users\Admin\AppData\Local\Temp\3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4424

C:\Users\Admin\AppData\Local\Temp\3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
C:\Users\Admin\AppData\Local\Temp\3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
3⤵
- Suspicious use of SetWindowsHookEx
PID:4608

C:\Windows\SysWOW64\diskperf.exe
"C:\Windows\SysWOW64\diskperf.exe"
3⤵
PID:4804

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4424-142-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/4424-136-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/4424-143-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/4424-144-0x0000000007180000-0x0000000007181000-memory.dmp

Filesize
4KB

Download
memory/4424-138-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/4424-139-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/4424-141-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/4424-140-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/4424-156-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/4424-135-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/4424-137-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/4424-146-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/4424-155-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/4608-154-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4608-150-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4608-161-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4608-159-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4764-134-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download

description	pid	process	target process
PID 4764 wrote to memory of 4420	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	cmd.exe
PID 4764 wrote to memory of 4420	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	cmd.exe
PID 4764 wrote to memory of 4420	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	cmd.exe
PID 4764 wrote to memory of 4424	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4764 wrote to memory of 4424	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4764 wrote to memory of 4424	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4764 wrote to memory of 4424	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4764 wrote to memory of 4424	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4764 wrote to memory of 4424	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4764 wrote to memory of 4424	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4764 wrote to memory of 4424	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4764 wrote to memory of 4424	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4764 wrote to memory of 4424	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4764 wrote to memory of 4424	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4764 wrote to memory of 4424	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4764 wrote to memory of 4424	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4764 wrote to memory of 4424	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4764 wrote to memory of 4424	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4764 wrote to memory of 4424	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4764 wrote to memory of 4424	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4764 wrote to memory of 4424	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4764 wrote to memory of 4424	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4764 wrote to memory of 4424	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4764 wrote to memory of 4424	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4764 wrote to memory of 4424	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4764 wrote to memory of 4424	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4764 wrote to memory of 4424	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4764 wrote to memory of 4424	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4764 wrote to memory of 4424	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4764 wrote to memory of 4424	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4764 wrote to memory of 4424	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4764 wrote to memory of 4424	4764	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4424 wrote to memory of 4608	4424	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4424 wrote to memory of 4608	4424	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4424 wrote to memory of 4608	4424	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4424 wrote to memory of 4608	4424	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4424 wrote to memory of 4608	4424	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4424 wrote to memory of 4608	4424	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4424 wrote to memory of 4608	4424	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4424 wrote to memory of 4608	4424	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 4424 wrote to memory of 4804	4424	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	diskperf.exe
PID 4424 wrote to memory of 4804	4424	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	diskperf.exe
PID 4424 wrote to memory of 4804	4424	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	diskperf.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads