8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4

General

Target
8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
Size 6.8MB
Sample261012-sztpbscs2w
SHA256 8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4
MD5 9d6abd747fc3944ed90db40c1455b26e
SHA1 088ae16ef974a7344e1c26c336550c8fd74e3d35
SHA512 6ae0d0a39d38523f6e8d1f26df46234aadb7e90d9f4234c6977bfabbcd102f68dba74ec673c6569be3317b2c1cbf7e7e198f0e463262488df4c079ca5d7510a0
SSDEEP 98304:AUZV5l14C0/5/CriLvKfjV4VsKJo2dz2a28WmzRt/n4AqZxhxGKeskflH:AI14CcFNLvKrV4GKldwmzRtfxoZqsk1
TLSH
T1A076334F96A9F27DEA356AFA85DB350A7E40E7158240C60B04D3F3B138D48AC9DAD353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution upx

Malware Config

Signatures

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5040-0-0x0000000000400000-0x00000000004F2000-memory.dmp	upx
behavioral2/memory/8-1-0x0000000000400000-0x00000000004F2000-memory.dmp	upx
behavioral2/memory/8-4-0x0000000000400000-0x00000000004F2000-memory.dmp	upx
behavioral2/memory/5040-43-0x0000000000400000-0x00000000004F2000-memory.dmp	upx
behavioral2/memory/2232-44-0x0000000000400000-0x00000000004F2000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4916	cmd.exe
3888	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeBackupPrivilege	5040	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
Token: SeRestorePrivilege	5040	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
Token: 33	5040	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
Token: SeIncBasePriorityPrivilege	5040	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
Token: 33	5040	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
Token: SeIncBasePriorityPrivilege	5040	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
Token: 33	5040	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
Token: SeIncBasePriorityPrivilege	5040	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
Token: SeBackupPrivilege	8	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
Token: SeRestorePrivilege	8	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
Token: 33	8	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
Token: SeIncBasePriorityPrivilege	8	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
Token: 33	5040	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
Token: SeIncBasePriorityPrivilege	5040	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
Token: SeBackupPrivilege	2232	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
Token: SeRestorePrivilege	2232	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
Token: 33	2232	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
Token: SeIncBasePriorityPrivilege	2232	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 4916	5040	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe	89
PID 5040 wrote to memory of 8	5040	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe	91
PID 5040 wrote to memory of 2232	5040	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe	92
PID 2232 wrote to memory of 3888	2232	8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe	93

C:\Users\Admin\AppData\Local\Temp\8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
"C:\Users\Admin\AppData\Local\Temp\8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c set
  2⤵
  - Executes a command shell one-liner
  PID:4916
- C:\Users\Admin\AppData\Local\Temp\8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
  PECMD**pecmd-cmd* PUTF -dd -skipb=518166 "C:\Users\Admin\AppData\Local\Temp\~1161918601775286465.tmp",,C:\Users\Admin\AppData\Local\Temp\8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:8
- C:\Users\Admin\AppData\Local\Temp\8874f4097c5564f7a8c07b5854d29d8f3dab383672ca490167f492b208fb64d4.exe
  PECMD**pecmd-cmd* EXEC -wd:C: -hide cmd /c "C:\Users\Admin\AppData\Local\Temp\~42309093623343357.cmd"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\~42309093623343357.cmd"
    3⤵
    - Executes a command shell one-liner
    PID:3888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

~11619~1.TMP

Path C:\Users\Admin\AppData\Local\Temp\~11619~1.TMP
Size 6.3MB
SHA256 81587cccdc760fcc88042486bee08050043c66371188fc06e6ac8e5418913f03
MD5 e5a5fa54fe9da51755609b5f3a918236
SHA1 b66f19998fbab87dfd7c11b7fbd01aba3de2a081
SHA512 1e4c2b5156603a7383cf26badd84457a677e89162234d854990c6c2fe0ee6ae78cdd87992ed772df70ddc95d304bd34ab817452bd311a949a2d3d92f13c94d22
SSDEEP 98304:F5l14C0/5/CriLvKfjV4VsKJo2dz2a28WmzRt/n4AqZxhxGKeskflH:Z14CcFNLvKrV4GKldwmzRtfxoZqsk1
TLSH
T1F466334F829AB67DDA39AAF685EB310B6D4067169340C60704D3F3B139C086C9DED7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~42309093623343357.cmd

Path C:\Users\Admin\AppData\Local\Temp\~42309093623343357.cmd
Size 373B
SHA256 43410f9e5b3d56749f9b2351b148c5029c8fda70dac46f3f218b9dbef8b94f8f
MD5 1f0589773623debd3bb9d35cbe36a12b
SHA1 d53ec39781a0af168052ed5b5e65e54aa54d5d29
SHA512 a343c2f84f98a1b64d66f81df160c6042d044fb145cad5f4fc57f267630f6737da6ed1d3384b604cde5896176030dada00ab7e4d5a1d77804db0eb9ea89ccd42
TLSH
T104E0228A658A8E9A1C20A8E799EE9488C1948A162F0CAFC487E091092543B689593EC6
MD5 SHA1 SHA512 TLSH

Submit Download

½âÂëÆ÷Ãû×Ö.txt

Path C:\Users\Admin\AppData\Local\Temp\~6008597453222897352\½âÂëÆ÷Ãû×Ö.txt
Size 24B
SHA256 1ba94fe1698d96f882854a7ed1fb3f9eaafa6f5347a05ebc9d08f0dc6beab6e5
MD5 9ecc846317a4ae8e5d203b0847f7bffc
SHA1 d9bfbb050303539dbd63780611af646b897ebfd6
SHA512 8e5f138c8fca3625d46ffb28dfb3ccc9745de0c49a8f1d05d90428f2c115502b9b76ae7e3e4d31381780f2d13044a3f1a218c230a8726ef9c27381552547d658
MD5 SHA1 SHA512

Submit Download

memory/8-1-0x0000000000400000-0x00000000004F2000-memory.dmp

Download

memory/8-4-0x0000000000400000-0x00000000004F2000-memory.dmp

Download

memory/2232-44-0x0000000000400000-0x00000000004F2000-memory.dmp

Download

memory/5040-0-0x0000000000400000-0x00000000004F2000-memory.dmp

Download

memory/5040-43-0x0000000000400000-0x00000000004F2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads