5511834808385536.zip

General
Target

485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe

Filesize

106KB

Completed

06-04-2020 23:09

Score
8 /10
MD5

8c7ba09e5e8a46926f2e9233c2cbf3c5

SHA1

29b031dc4829b82bc35382ed3b00202653af6eee

SHA256

485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf

Malware Config
Signatures 8

Filter: none

Lateral Movement
Persistence
  • Drops startup file
    485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    File opened for modificationC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
  • Drops autorun.inf file
    485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe

    TTPs

    Replication Through Removable Media

    Reported IOCs

    descriptioniocprocess
    File createdC:\autorun.inf485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    File opened for modificationC:\autorun.inf485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
  • Disables Task Manager via registry modification

    Tags

  • Suspicious use of WriteProcessMemory
    485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2500 wrote to memory of 28122500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exenetsh.exe
    PID 2500 wrote to memory of 28122500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exenetsh.exe
    PID 2500 wrote to memory of 28122500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exenetsh.exe
  • Suspicious use of AdjustPrivilegeToken
    485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 332500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 332500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 332500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 332500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 332500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 332500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 332500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 332500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 332500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 332500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 332500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 332500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 332500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 332500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 332500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 332500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 332500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
  • Suspicious behavior: EnumeratesProcesses
    485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe

    Reported IOCs

    pidprocess
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
  • Suspicious behavior: GetForegroundWindowSpam
    485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe

    Reported IOCs

    pidprocess
    2500485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
  • Modifies Windows Firewall

    Tags

    TTPs

    Modify Existing Service
Processes 2
  • C:\Users\Admin\AppData\Local\Temp\485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    "C:\Users\Admin\AppData\Local\Temp\485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe"
    Drops startup file
    Drops autorun.inf file
    Suspicious use of WriteProcessMemory
    Suspicious use of AdjustPrivilegeToken
    Suspicious behavior: EnumeratesProcesses
    Suspicious behavior: GetForegroundWindowSpam
    PID:2500
    • C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe" "485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe" ENABLE
      PID:2812
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads