4d7e3818fcaa4b55056d58e20420d10fe1d8e56fbd6059d0a716c877f73aaa5d

General
Target

4d7e3818fcaa4b55056d58e20420d10fe1d8e56fbd6059d0a716c877f73aaa5d.exe

Filesize

78KB

Completed

28-02-2021 07:11

Score
8/10
MD5

0106ede4fe7c8704ea04b3f66c5d80d6

SHA1

59d774bed7c7c8f76de7fa436e238413870d16b6

SHA256

4d7e3818fcaa4b55056d58e20420d10fe1d8e56fbd6059d0a716c877f73aaa5d

Malware Config
Signatures 8

Filter: none

Defense Evasion
Discovery
Persistence
  • Executes dropped EXE
    tmp1C5.tmp.exe

    Reported IOCs

    pidprocess
    1784tmp1C5.tmp.exe
  • Deletes itself
    tmp1C5.tmp.exe

    Reported IOCs

    pidprocess
    1784tmp1C5.tmp.exe
  • Loads dropped DLL
    4d7e3818fcaa4b55056d58e20420d10fe1d8e56fbd6059d0a716c877f73aaa5d.exe

    Reported IOCs

    pidprocess
    15764d7e3818fcaa4b55056d58e20420d10fe1d8e56fbd6059d0a716c877f73aaa5d.exe
    15764d7e3818fcaa4b55056d58e20420d10fe1d8e56fbd6059d0a716c877f73aaa5d.exe
  • Uses the VBS compiler for execution

    TTPs

    Scripting
  • Adds Run key to start application
    tmp1C5.tmp.exe

    TTPs

    Registry Run Keys / Startup FolderModify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ShFusRes = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\big5.exe\""tmp1C5.tmp.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Suspicious use of AdjustPrivilegeToken
    4d7e3818fcaa4b55056d58e20420d10fe1d8e56fbd6059d0a716c877f73aaa5d.exetmp1C5.tmp.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege15764d7e3818fcaa4b55056d58e20420d10fe1d8e56fbd6059d0a716c877f73aaa5d.exe
    Token: SeDebugPrivilege1784tmp1C5.tmp.exe
  • Suspicious use of WriteProcessMemory
    4d7e3818fcaa4b55056d58e20420d10fe1d8e56fbd6059d0a716c877f73aaa5d.exevbc.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1576 wrote to memory of 196415764d7e3818fcaa4b55056d58e20420d10fe1d8e56fbd6059d0a716c877f73aaa5d.exevbc.exe
    PID 1576 wrote to memory of 196415764d7e3818fcaa4b55056d58e20420d10fe1d8e56fbd6059d0a716c877f73aaa5d.exevbc.exe
    PID 1576 wrote to memory of 196415764d7e3818fcaa4b55056d58e20420d10fe1d8e56fbd6059d0a716c877f73aaa5d.exevbc.exe
    PID 1576 wrote to memory of 196415764d7e3818fcaa4b55056d58e20420d10fe1d8e56fbd6059d0a716c877f73aaa5d.exevbc.exe
    PID 1964 wrote to memory of 19361964vbc.execvtres.exe
    PID 1964 wrote to memory of 19361964vbc.execvtres.exe
    PID 1964 wrote to memory of 19361964vbc.execvtres.exe
    PID 1964 wrote to memory of 19361964vbc.execvtres.exe
    PID 1576 wrote to memory of 178415764d7e3818fcaa4b55056d58e20420d10fe1d8e56fbd6059d0a716c877f73aaa5d.exetmp1C5.tmp.exe
    PID 1576 wrote to memory of 178415764d7e3818fcaa4b55056d58e20420d10fe1d8e56fbd6059d0a716c877f73aaa5d.exetmp1C5.tmp.exe
    PID 1576 wrote to memory of 178415764d7e3818fcaa4b55056d58e20420d10fe1d8e56fbd6059d0a716c877f73aaa5d.exetmp1C5.tmp.exe
    PID 1576 wrote to memory of 178415764d7e3818fcaa4b55056d58e20420d10fe1d8e56fbd6059d0a716c877f73aaa5d.exetmp1C5.tmp.exe
Processes 4
  • C:\Users\Admin\AppData\Local\Temp\4d7e3818fcaa4b55056d58e20420d10fe1d8e56fbd6059d0a716c877f73aaa5d.exe
    "C:\Users\Admin\AppData\Local\Temp\4d7e3818fcaa4b55056d58e20420d10fe1d8e56fbd6059d0a716c877f73aaa5d.exe"
    Loads dropped DLL
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:1576
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pnwhro_y.cmdline"
      Suspicious use of WriteProcessMemory
      PID:1964
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES31D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc31C.tmp"
        PID:1936
    • C:\Users\Admin\AppData\Local\Temp\tmp1C5.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp1C5.tmp.exe" C:\Users\Admin\AppData\Local\Temp\4d7e3818fcaa4b55056d58e20420d10fe1d8e56fbd6059d0a716c877f73aaa5d.exe
      Executes dropped EXE
      Deletes itself
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      PID:1784
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Privilege Escalation
                    Replay Monitor
                    00:00 00:00
                    Downloads
                    • C:\Users\Admin\AppData\Local\Temp\RES31D.tmp

                      MD5

                      0ae325baffd3e3f23f11c3a871318ea7

                      SHA1

                      7d44eed22336c667d39743ed80318f1d0129e725

                      SHA256

                      84019488fba43d662e419d41a20c0bb48e7a7e679ec7dc799f7187ec81014ab9

                      SHA512

                      3ac0782c6189ae1eb9cf70004bc2d0a7907f4773ac661a24df561486b0ab020f98d9c121f105baad1f7fa5b01b95effa98da36a8581b40acef3f30d8c93a64d9

                    • C:\Users\Admin\AppData\Local\Temp\pnwhro_y.0.vb

                      MD5

                      36dff28cce69d1b183aa6c22c3294aae

                      SHA1

                      df66dd3a42ab029b21bac3279a8c683032004cdf

                      SHA256

                      603007ad164d9eeb20e76d17c77337fd50a2d96690de7c496577b0a557334502

                      SHA512

                      a1d3200c7a76886d49604dc61dbdc9b1d6435ac4674a00bc86c0f4e3dc41df2655ce0ecadbc7a557e31b392d95c4553bf63eadad5c8507a8a28dfbeeb4433dbd

                    • C:\Users\Admin\AppData\Local\Temp\pnwhro_y.cmdline

                      MD5

                      17b6bbcd32a47c41faf53d878fb9395a

                      SHA1

                      a1146f7904ea64c3f81bb497d44309dfc6d1480b

                      SHA256

                      9f40401a76223a00bfdea9350460009094dc599287d148fa20f361869128f85b

                      SHA512

                      703d904ca9d711e87fac4e8cda8f065812d382a22467cf8c137c1026033a21021169c41a4b6d1fa8a7feb6208e06b96bc1faaf90fbe1a70389f10a455d51ecf2

                    • C:\Users\Admin\AppData\Local\Temp\tmp1C5.tmp.exe

                      MD5

                      6a693d2fd49929cc495a4706573e7ff9

                      SHA1

                      34e088cd068ce44335c5cef12d61f913d2ad168a

                      SHA256

                      a49d8a8934100261b9f76fec642f1bf2a3da2f3c293cc7a01f8f0be197859d26

                      SHA512

                      a3ad3ec34d45a21fc5417e45841a4049c10b4ca461fd25f5619c65c814eb51990baa48f36a02f9df6c2b81baf552e0bb83460e017dea6cf102e5e0bee963a885

                    • C:\Users\Admin\AppData\Local\Temp\tmp1C5.tmp.exe

                      MD5

                      6a693d2fd49929cc495a4706573e7ff9

                      SHA1

                      34e088cd068ce44335c5cef12d61f913d2ad168a

                      SHA256

                      a49d8a8934100261b9f76fec642f1bf2a3da2f3c293cc7a01f8f0be197859d26

                      SHA512

                      a3ad3ec34d45a21fc5417e45841a4049c10b4ca461fd25f5619c65c814eb51990baa48f36a02f9df6c2b81baf552e0bb83460e017dea6cf102e5e0bee963a885

                    • C:\Users\Admin\AppData\Local\Temp\vbc31C.tmp

                      MD5

                      75406e6f33f9a1f3a00b4e51b2df31ef

                      SHA1

                      847fc8a6f51d0a5bce417fb7b413541bf0cbc2a7

                      SHA256

                      f892fb45345eab8488e516638a0e252ef4b0013a6ed07db9fb217fd80d5e8898

                      SHA512

                      2f491227c8f4e767344a517ee163474e01d8bfefe3338b4ef1d217e6ccd663515ac2ee5dd91c0607d6592a12b26242bf9d97e5dc420ff9f326ee975970accead

                    • C:\Users\Admin\AppData\Local\Temp\zCom.resources

                      MD5

                      4f0e8cf79edb6cd381474b21cabfdf4a

                      SHA1

                      7018c96b4c5dab7957d4bcdc82c1e7bb3a4f80c4

                      SHA256

                      e54a257fa391065c120f55841de8c11116ea0e601d90fe1a35dcd340c5dd9cd5

                      SHA512

                      2451a59d09464e30d0df822d9322dbecb83faa92c5a5b71b7b9db62330c40cc7570d66235f137290074a3c4a9f3d8b3447067ed135f1bb60ea9e18d0df39a107

                    • \Users\Admin\AppData\Local\Temp\tmp1C5.tmp.exe

                      MD5

                      6a693d2fd49929cc495a4706573e7ff9

                      SHA1

                      34e088cd068ce44335c5cef12d61f913d2ad168a

                      SHA256

                      a49d8a8934100261b9f76fec642f1bf2a3da2f3c293cc7a01f8f0be197859d26

                      SHA512

                      a3ad3ec34d45a21fc5417e45841a4049c10b4ca461fd25f5619c65c814eb51990baa48f36a02f9df6c2b81baf552e0bb83460e017dea6cf102e5e0bee963a885

                    • \Users\Admin\AppData\Local\Temp\tmp1C5.tmp.exe

                      MD5

                      6a693d2fd49929cc495a4706573e7ff9

                      SHA1

                      34e088cd068ce44335c5cef12d61f913d2ad168a

                      SHA256

                      a49d8a8934100261b9f76fec642f1bf2a3da2f3c293cc7a01f8f0be197859d26

                      SHA512

                      a3ad3ec34d45a21fc5417e45841a4049c10b4ca461fd25f5619c65c814eb51990baa48f36a02f9df6c2b81baf552e0bb83460e017dea6cf102e5e0bee963a885

                    • memory/1576-14-0x0000000001F60000-0x0000000001F61000-memory.dmp

                    • memory/1576-2-0x0000000075A41000-0x0000000075A43000-memory.dmp

                    • memory/1784-17-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

                    • memory/1784-13-0x0000000000000000-mapping.dmp

                    • memory/1784-19-0x0000000000AE5000-0x0000000000AF6000-memory.dmp

                    • memory/1936-7-0x0000000000000000-mapping.dmp

                    • memory/1964-18-0x0000000002110000-0x0000000002111000-memory.dmp

                    • memory/1964-3-0x0000000000000000-mapping.dmp