adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e

General

Target

adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe
Size

1.1MB
MD5

771d64a701a7827fb3229f98ad3ff858
SHA1

22b487be37f13797100c3348e1c9a3a254b41abc
SHA256

adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e
SHA512

662cc2147d316c4de5891f40639ede5d77caf97ea10cc2127e2b1066f286f22ada17ae0b57ab99ffd9f98e4ebbc6355cec2c8da86ebe7198a4a6bde2e33181eb

Score

8^/10

persistence

Malware Config

Signatures

NTFS ADS 1 IoCs

Processes:

adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe

description ioc process

File created C:\ProgramData:ApplicationData adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe

description	ioc	process
File created	C:\ProgramData:ApplicationData	adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe

Adds Run entry to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe"	adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe

Suspicious use of SendNotifyMessage 6 IoCs

Processes:

adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exeimages.exe

pid	process
2600	adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe
2600	adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe
2600	adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe
3236	images.exe
3236	images.exe
3236	images.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exeadfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exeimages.exeimages.exe

description	pid	process	target process
PID 2600 wrote to memory of 3992	2600	adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe	adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe
PID 2600 wrote to memory of 3992	2600	adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe	adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe
PID 2600 wrote to memory of 3992	2600	adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe	adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe
PID 2600 wrote to memory of 3992	2600	adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe	adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe
PID 2600 wrote to memory of 3992	2600	adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe	adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe
PID 3992 wrote to memory of 3260	3992	adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe	powershell.exe
PID 3992 wrote to memory of 3260	3992	adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe	powershell.exe
PID 3992 wrote to memory of 3260	3992	adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe	powershell.exe
PID 3992 wrote to memory of 3236	3992	adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe	images.exe
PID 3992 wrote to memory of 3236	3992	adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe	images.exe
PID 3992 wrote to memory of 3236	3992	adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe	images.exe
PID 3236 wrote to memory of 740	3236	images.exe	images.exe
PID 3236 wrote to memory of 740	3236	images.exe	images.exe
PID 3236 wrote to memory of 740	3236	images.exe	images.exe
PID 3236 wrote to memory of 740	3236	images.exe	images.exe
PID 3236 wrote to memory of 740	3236	images.exe	images.exe
PID 740 wrote to memory of 2568	740	images.exe	powershell.exe
PID 740 wrote to memory of 2568	740	images.exe	powershell.exe
PID 740 wrote to memory of 2568	740	images.exe	powershell.exe
PID 740 wrote to memory of 3100	740	images.exe	cmd.exe
PID 740 wrote to memory of 3100	740	images.exe	cmd.exe
PID 740 wrote to memory of 3100	740	images.exe	cmd.exe
PID 740 wrote to memory of 3100	740	images.exe	cmd.exe
PID 740 wrote to memory of 3100	740	images.exe	cmd.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exeimages.exe

description	pid	process	target process
PID 2600 set thread context of 3992	2600	adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe	adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe
PID 3236 set thread context of 740	3236	images.exe	images.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3476 3260 WerFault.exe powershell.exe

pid	pid_target	process	target process
3476	3260	WerFault.exe	powershell.exe

Drops startup file 3 IoCs

Processes:

adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exeadfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AcXtrnal.url	adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat	adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start	adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exeimages.exe

pid	process
2600	adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe
2600	adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe
2600	adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe
3236	images.exe
3236	images.exe
3236	images.exe

Executes dropped EXE 2 IoCs

Processes:

images.exeimages.exe

pid process

3236 images.exe
740 images.exe

pid	process
3236	images.exe
740	images.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

WerFault.exepowershell.exe

description	pid	process
Token: SeRestorePrivilege	3476	WerFault.exe
Token: SeBackupPrivilege	3476	WerFault.exe
Token: SeDebugPrivilege	3476	WerFault.exe
Token: SeDebugPrivilege	2568	powershell.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

WerFault.exepowershell.exe

pid	process
3476	WerFault.exe
3476	WerFault.exe
3476	WerFault.exe
3476	WerFault.exe
3476	WerFault.exe
3476	WerFault.exe
3476	WerFault.exe
3476	WerFault.exe
3476	WerFault.exe
3476	WerFault.exe
3476	WerFault.exe
3476	WerFault.exe
3476	WerFault.exe
3476	WerFault.exe
2568	powershell.exe
2568	powershell.exe
2568	powershell.exe

C:\Users\Admin\AppData\Local\Temp\adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe
"C:\Users\Admin\AppData\Local\Temp\adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe"
1⤵
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Drops startup file
- Suspicious use of FindShellTrayWindow
PID:2600

C:\Users\Admin\AppData\Local\Temp\adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe
"C:\Users\Admin\AppData\Local\Temp\adfda243fa85cb545751d4639b844332843eec5dd4d424bc973005bff84ec17e.exe"
2⤵
- NTFS ADS
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
- Drops startup file
PID:3992

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath C:\
3⤵
PID:3260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 704
4⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3476

C:\ProgramData\images.exe
"C:\ProgramData\images.exe"
3⤵
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Executes dropped EXE
PID:3236

C:\ProgramData\images.exe
"C:\ProgramData\images.exe"
4⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:740

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath C:\
5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2568

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
5⤵
PID:3100

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\

Download Submit
C:\ProgramData\images.exe

Download Submit
C:\ProgramData\images.exe

Download Submit
C:\ProgramData\images.exe

Download Submit
memory/740-16-0x0000000000405907-mapping.dmp

Download
memory/2568-22-0x0000000000000000-mapping.dmp

Download
memory/3100-24-0x0000000000000000-mapping.dmp

Download
memory/3100-23-0x0000000000000000-mapping.dmp

Download
memory/3236-3-0x0000000000000000-mapping.dmp

Download
memory/3260-11-0x0000000000000000-mapping.dmp

Download
memory/3260-10-0x0000000000000000-mapping.dmp

Download
memory/3260-9-0x0000000000000000-mapping.dmp

Download
memory/3260-12-0x0000000000000000-mapping.dmp

Download
memory/3260-13-0x0000000000000000-mapping.dmp

Download
memory/3260-8-0x0000000000000000-mapping.dmp

Download
memory/3260-2-0x0000000000000000-mapping.dmp

Download
memory/3476-14-0x0000000004F30000-0x0000000004F31000-memory.dmp

Filesize
4KB

Download
memory/3476-7-0x0000000004A00000-0x0000000004A01000-memory.dmp

Filesize
4KB

Download
memory/3992-0-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/3992-1-0x0000000000405907-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads