1181cfd2b34e7be8a43ea7335ae541ee72c2fb50ab86c1ca0155864965766a55

General

Target

GJKF64.exe
Size

37KB
MD5

c9888d06d21e682ae62498e24880d139
SHA1

1dd9679e1792468116e7da109fdf3a89a4fa1bb2
SHA256

1181cfd2b34e7be8a43ea7335ae541ee72c2fb50ab86c1ca0155864965766a55
SHA512

205e2ed37e809bf7e7db818b5f55d99bfcaba55d3875301e5fb77285fb1e1c977b11ddd34358773145add1f405330f3b426b0c8bd0ab64600007e866c0ebc9ce
SSDEEP

768:MetU1hGx8VAXQul37B5t8Rsr55U9EuB6SLFo5:M+uM5iCc9Po4O5

Score

8^/10

evasion persistence

Malware Config

Signatures

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2868	attrib.exe
2712	attrib.exe

Executes dropped EXE 1 IoCs

pid	Process
2656	$77cc.exe

Loads dropped DLL 2 IoCs

pid	Process
2644	cmd.exe
2644	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\cc\\$77cc.exe\""	GJKF64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2928	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2596	timeout.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2664	GJKF64.exe
2664	GJKF64.exe
2664	GJKF64.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2664	GJKF64.exe
Token: SeDebugPrivilege	2656	$77cc.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2712	2664	GJKF64.exe	31
PID 2664 wrote to memory of 2712	2664	GJKF64.exe	31
PID 2664 wrote to memory of 2712	2664	GJKF64.exe	31
PID 2664 wrote to memory of 2868	2664	GJKF64.exe	29
PID 2664 wrote to memory of 2868	2664	GJKF64.exe	29
PID 2664 wrote to memory of 2868	2664	GJKF64.exe	29
PID 2664 wrote to memory of 2644	2664	GJKF64.exe	34
PID 2664 wrote to memory of 2644	2664	GJKF64.exe	34
PID 2664 wrote to memory of 2644	2664	GJKF64.exe	34
PID 2644 wrote to memory of 2596	2644	cmd.exe	32
PID 2644 wrote to memory of 2596	2644	cmd.exe	32
PID 2644 wrote to memory of 2596	2644	cmd.exe	32
PID 2644 wrote to memory of 2656	2644	cmd.exe	35
PID 2644 wrote to memory of 2656	2644	cmd.exe	35
PID 2644 wrote to memory of 2656	2644	cmd.exe	35
PID 2656 wrote to memory of 1676	2656	$77cc.exe	37
PID 2656 wrote to memory of 1676	2656	$77cc.exe	37
PID 2656 wrote to memory of 1676	2656	$77cc.exe	37

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2868	attrib.exe
2712	attrib.exe

C:\Users\Admin\AppData\Local\Temp\GJKF64.exe
"C:\Users\Admin\AppData\Local\Temp\GJKF64.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\cc\$77cc.exe"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:2868
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\cc"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:2712
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpAFDF.tmp.bat""
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Users\Admin\AppData\Roaming\cc\$77cc.exe
    "C:\Users\Admin\AppData\Roaming\cc\$77cc.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Windows\system32\schtasks.exe
      "schtasks.exe" /query /TN $77cc.exe
      4⤵
      PID:1676
  - - C:\Windows\system32\schtasks.exe
      "schtasks.exe" /Create /SC ONCE /TN "$77cc.exe" /TR "C:\Users\Admin\AppData\Roaming\cc\$77cc.exe \"\$77cc.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:2928
  - - C:\Windows\system32\schtasks.exe
      "schtasks.exe" /query /TN $77cc.exe
      4⤵
      PID:2024
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit
      4⤵
      PID:3036

C:\Windows\system32\timeout.exe
timeout 3
1⤵
- Delays execution with timeout.exe
PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Hide Artifacts

2

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpAFDF.tmp.bat

Filesize
152B

MD5
cfef98717d253223bf11a7d8ba5abc64

SHA1
9f9c9ad6f8c9303772e031fe5272b5ca5030dbfc

SHA256
5876477f53024779f97b05ad14b273a9bde144a842cfbeac2289cafd0cd311b1

SHA512
23d8250dec9df623b66c7e09a823679d030b9412f3d7c4bdb5e870dbbf45ed2b1a5b977df8a44e7550fb4eb8a977a2cebcbf11446d6f1db0e8186a3c1f98d78c

Download Submit
C:\Users\Admin\AppData\Roaming\cc\$77cc.exe

Filesize
37KB

MD5
c9888d06d21e682ae62498e24880d139

SHA1
1dd9679e1792468116e7da109fdf3a89a4fa1bb2

SHA256
1181cfd2b34e7be8a43ea7335ae541ee72c2fb50ab86c1ca0155864965766a55

SHA512
205e2ed37e809bf7e7db818b5f55d99bfcaba55d3875301e5fb77285fb1e1c977b11ddd34358773145add1f405330f3b426b0c8bd0ab64600007e866c0ebc9ce

Download Submit
memory/2656-33-0x000007FEF4DC0000-0x000007FEF57AC000-memory.dmp

Filesize
9.9MB

Download
memory/2656-18-0x000000013FDB0000-0x000000013FDBC000-memory.dmp

Filesize
48KB

Download
memory/2656-19-0x000007FEF4DC0000-0x000007FEF57AC000-memory.dmp

Filesize
9.9MB

Download
memory/2656-20-0x00000000009D0000-0x0000000000A50000-memory.dmp

Filesize
512KB

Download
memory/2664-1-0x000007FEF57B0000-0x000007FEF619C000-memory.dmp

Filesize
9.9MB

Download
memory/2664-2-0x000000001BC30000-0x000000001BCB0000-memory.dmp

Filesize
512KB

Download
memory/2664-3-0x000007FEF57B0000-0x000007FEF619C000-memory.dmp

Filesize
9.9MB

Download
memory/2664-13-0x000007FEF57B0000-0x000007FEF619C000-memory.dmp

Filesize
9.9MB

Download
memory/2664-0-0x000000013F300000-0x000000013F30C000-memory.dmp

Filesize
48KB

Download
memory/3036-25-0x000000001B320000-0x000000001B602000-memory.dmp

Filesize
2.9MB

Download
memory/3036-27-0x000007FEEE210000-0x000007FEEEBAD000-memory.dmp

Filesize
9.6MB

Download
memory/3036-31-0x0000000002490000-0x0000000002510000-memory.dmp

Filesize
512KB

Download
memory/3036-32-0x000007FEEE210000-0x000007FEEEBAD000-memory.dmp

Filesize
9.6MB

Download
memory/3036-30-0x0000000002490000-0x0000000002510000-memory.dmp

Filesize
512KB

Download
memory/3036-29-0x0000000002490000-0x0000000002510000-memory.dmp

Filesize
512KB

Download
memory/3036-28-0x0000000002490000-0x0000000002510000-memory.dmp

Filesize
512KB

Download
memory/3036-26-0x0000000002510000-0x0000000002518000-memory.dmp

Filesize
32KB

Download
memory/3036-34-0x000007FEEE210000-0x000007FEEEBAD000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads