9ba51214333477ae300087e1282552255cf58f5b4bdcddf603ec09f1e43c93b0

General

Target

9ba51214333477ae300087e1282552255cf58f5b4bdcddf603ec09f1e43c93b0.exe
Size

886KB
MD5

49a1975e7e03961faf447f28e543a873
SHA1

3028e9b07977fb4596d9709c8b3fea139db0d0cf
SHA256

9ba51214333477ae300087e1282552255cf58f5b4bdcddf603ec09f1e43c93b0
SHA512

6f33cb98ebdab30efd2fc99966f989f2b4346132d7050424b2c059d55e67f2fcadd04942c66440150d2b0778f4539f859401b5d429fe917e889d0cfc485cd9aa
SSDEEP

12288:+3pnF6Ee+Rp4tqkWjQ+iOklku0/04gNphgBBO75nONT3vx2zVPK:+ZZe0p4Ek4niOkl/A04szE87JKTvmi

Score

9^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 6 IoCs

resource	yara_rule
behavioral1/memory/1936-1-0x0000000000400000-0x0000000000418000-memory.dmp	UPX
behavioral1/memory/2092-19-0x0000000000400000-0x0000000000418000-memory.dmp	UPX
behavioral1/memory/3040-18-0x0000000000400000-0x0000000000418000-memory.dmp	UPX
behavioral1/files/0x000c00000001226d-15.dat	UPX
behavioral1/memory/1936-12-0x0000000000400000-0x0000000000418000-memory.dmp	UPX
behavioral1/memory/2092-26-0x0000000000400000-0x0000000000418000-memory.dmp	UPX

Executes dropped EXE 3 IoCs

pid	Process
3040	MSWDM.EXE
2092	MSWDM.EXE
2756	9BA51214333477AE300087E1282552255CF58F5B4BDCDDF603EC09F1E43C93B0.EXE

Loads dropped DLL 2 IoCs

pid	Process
3040	MSWDM.EXE
3040	MSWDM.EXE

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1936-1-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral1/memory/2092-19-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral1/memory/3040-18-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral1/files/0x000c00000001226d-15.dat	upx
behavioral1/memory/1936-12-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral1/memory/2092-26-0x0000000000400000-0x0000000000418000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	9ba51214333477ae300087e1282552255cf58f5b4bdcddf603ec09f1e43c93b0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	9ba51214333477ae300087e1282552255cf58f5b4bdcddf603ec09f1e43c93b0.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\dev1861.tmp	9ba51214333477ae300087e1282552255cf58f5b4bdcddf603ec09f1e43c93b0.exe
File created	C:\WINDOWS\MSWDM.EXE	9ba51214333477ae300087e1282552255cf58f5b4bdcddf603ec09f1e43c93b0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3040	MSWDM.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2756	9BA51214333477AE300087E1282552255CF58F5B4BDCDDF603EC09F1E43C93B0.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2756	9BA51214333477AE300087E1282552255CF58F5B4BDCDDF603EC09F1E43C93B0.EXE
Token: 35	2756	9BA51214333477AE300087E1282552255CF58F5B4BDCDDF603EC09F1E43C93B0.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2092	1936	9ba51214333477ae300087e1282552255cf58f5b4bdcddf603ec09f1e43c93b0.exe	28
PID 1936 wrote to memory of 2092	1936	9ba51214333477ae300087e1282552255cf58f5b4bdcddf603ec09f1e43c93b0.exe	28
PID 1936 wrote to memory of 2092	1936	9ba51214333477ae300087e1282552255cf58f5b4bdcddf603ec09f1e43c93b0.exe	28
PID 1936 wrote to memory of 2092	1936	9ba51214333477ae300087e1282552255cf58f5b4bdcddf603ec09f1e43c93b0.exe	28
PID 1936 wrote to memory of 3040	1936	9ba51214333477ae300087e1282552255cf58f5b4bdcddf603ec09f1e43c93b0.exe	29
PID 1936 wrote to memory of 3040	1936	9ba51214333477ae300087e1282552255cf58f5b4bdcddf603ec09f1e43c93b0.exe	29
PID 1936 wrote to memory of 3040	1936	9ba51214333477ae300087e1282552255cf58f5b4bdcddf603ec09f1e43c93b0.exe	29
PID 1936 wrote to memory of 3040	1936	9ba51214333477ae300087e1282552255cf58f5b4bdcddf603ec09f1e43c93b0.exe	29
PID 3040 wrote to memory of 2756	3040	MSWDM.EXE	30
PID 3040 wrote to memory of 2756	3040	MSWDM.EXE	30
PID 3040 wrote to memory of 2756	3040	MSWDM.EXE	30
PID 3040 wrote to memory of 2756	3040	MSWDM.EXE	30

C:\Users\Admin\AppData\Local\Temp\9ba51214333477ae300087e1282552255cf58f5b4bdcddf603ec09f1e43c93b0.exe
"C:\Users\Admin\AppData\Local\Temp\9ba51214333477ae300087e1282552255cf58f5b4bdcddf603ec09f1e43c93b0.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1936
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2092
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev1861.tmp!C:\Users\Admin\AppData\Local\Temp\9ba51214333477ae300087e1282552255cf58f5b4bdcddf603ec09f1e43c93b0.exe! !
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Users\Admin\AppData\Local\Temp\9BA51214333477AE300087E1282552255CF58F5B4BDCDDF603EC09F1E43C93B0.EXE
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\MSWDM.EXE

Filesize
39KB

MD5
fcdbf839561963c0153432aafb2edd88

SHA1
d34b2c4fd725774f93d34ce411caee8a72c3cd46

SHA256
fd42fb02fe0e758cff209dabd8916a27cc9ae96632cb491eb0d484410a91f127

SHA512
f2e8e8257b26981cb6baf0d52d20f16ca5ed9649c4447da631a362261bbc933ab4255b9dbedc6e5852bf2c01bb5fd8d43d7b72d0457fb927713a1e35602d5c07

Download Submit
C:\Windows\dev1861.tmp

Filesize
847KB

MD5
c8f40f25f783a52262bdaedeb5555427

SHA1
e45e198607c8d7398745baa71780e3e7a2f6deca

SHA256
e81b44ee7381ae3b630488b6fb7e3d9ffbdd9ac3032181d4ccaaff3409b57316

SHA512
f5944743f54028eb1dd0f2d68468726b177d33185324da0da96cdd20768bab4ca2e507ae9157b2733fd6240c920b7e15a5f5b9f284ee09d0fd385fc895b97191

Download Submit
memory/1936-1-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1936-12-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2092-19-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2092-26-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3040-18-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads