a045c1cc2b85a5106a89a970262a3ba07dc65d96573401f1f31b4f9867ba7130

General

Target

98d5dd6c09fa093e791e3c18a9526859.exe
Size

307KB
MD5

98d5dd6c09fa093e791e3c18a9526859
SHA1

758dbd528a61ac56767fab89600c1656d20693bd
SHA256

a045c1cc2b85a5106a89a970262a3ba07dc65d96573401f1f31b4f9867ba7130
SHA512

bc4c4875694b7f6d9e01712a6b9e86352bd1350acb4357031c4a688af9b942835cb52e36ff35ffef3f639eb6fd372c8deb8aa0bb48aadf0ed4b376aa1035882a

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1820 taskkill.exe
Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

564 PING.EXE
1672 PING.EXE

pid	process
1820	taskkill.exe

pid	process
564	PING.EXE
1672	PING.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WMIC.exetaskkill.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1700	WMIC.exe
Token: SeSecurityPrivilege	1700	WMIC.exe
Token: SeTakeOwnershipPrivilege	1700	WMIC.exe
Token: SeLoadDriverPrivilege	1700	WMIC.exe
Token: SeSystemProfilePrivilege	1700	WMIC.exe
Token: SeSystemtimePrivilege	1700	WMIC.exe
Token: SeProfSingleProcessPrivilege	1700	WMIC.exe
Token: SeIncBasePriorityPrivilege	1700	WMIC.exe
Token: SeCreatePagefilePrivilege	1700	WMIC.exe
Token: SeBackupPrivilege	1700	WMIC.exe
Token: SeRestorePrivilege	1700	WMIC.exe
Token: SeShutdownPrivilege	1700	WMIC.exe
Token: SeDebugPrivilege	1700	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1700	WMIC.exe
Token: SeRemoteShutdownPrivilege	1700	WMIC.exe
Token: SeUndockPrivilege	1700	WMIC.exe
Token: SeManageVolumePrivilege	1700	WMIC.exe
Token: 33	1700	WMIC.exe
Token: 34	1700	WMIC.exe
Token: 35	1700	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1700	WMIC.exe
Token: SeSecurityPrivilege	1700	WMIC.exe
Token: SeTakeOwnershipPrivilege	1700	WMIC.exe
Token: SeLoadDriverPrivilege	1700	WMIC.exe
Token: SeSystemProfilePrivilege	1700	WMIC.exe
Token: SeSystemtimePrivilege	1700	WMIC.exe
Token: SeProfSingleProcessPrivilege	1700	WMIC.exe
Token: SeIncBasePriorityPrivilege	1700	WMIC.exe
Token: SeCreatePagefilePrivilege	1700	WMIC.exe
Token: SeBackupPrivilege	1700	WMIC.exe
Token: SeRestorePrivilege	1700	WMIC.exe
Token: SeShutdownPrivilege	1700	WMIC.exe
Token: SeDebugPrivilege	1700	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1700	WMIC.exe
Token: SeRemoteShutdownPrivilege	1700	WMIC.exe
Token: SeUndockPrivilege	1700	WMIC.exe
Token: SeManageVolumePrivilege	1700	WMIC.exe
Token: 33	1700	WMIC.exe
Token: 34	1700	WMIC.exe
Token: 35	1700	WMIC.exe
Token: SeDebugPrivilege	1820	taskkill.exe
Token: SeIncreaseQuotaPrivilege	908	WMIC.exe
Token: SeSecurityPrivilege	908	WMIC.exe
Token: SeTakeOwnershipPrivilege	908	WMIC.exe
Token: SeLoadDriverPrivilege	908	WMIC.exe
Token: SeSystemProfilePrivilege	908	WMIC.exe
Token: SeSystemtimePrivilege	908	WMIC.exe
Token: SeProfSingleProcessPrivilege	908	WMIC.exe
Token: SeIncBasePriorityPrivilege	908	WMIC.exe
Token: SeCreatePagefilePrivilege	908	WMIC.exe
Token: SeBackupPrivilege	908	WMIC.exe
Token: SeRestorePrivilege	908	WMIC.exe
Token: SeShutdownPrivilege	908	WMIC.exe
Token: SeDebugPrivilege	908	WMIC.exe
Token: SeSystemEnvironmentPrivilege	908	WMIC.exe
Token: SeRemoteShutdownPrivilege	908	WMIC.exe
Token: SeUndockPrivilege	908	WMIC.exe
Token: SeManageVolumePrivilege	908	WMIC.exe
Token: 33	908	WMIC.exe
Token: 34	908	WMIC.exe
Token: 35	908	WMIC.exe
Token: SeIncreaseQuotaPrivilege	908	WMIC.exe
Token: SeSecurityPrivilege	908	WMIC.exe
Token: SeTakeOwnershipPrivilege	908	WMIC.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

98d5dd6c09fa093e791e3c18a9526859.exeWScript.execmd.exe

description	pid	process	target process
PID 788 wrote to memory of 1984	788	98d5dd6c09fa093e791e3c18a9526859.exe	WScript.exe
PID 788 wrote to memory of 1984	788	98d5dd6c09fa093e791e3c18a9526859.exe	WScript.exe
PID 788 wrote to memory of 1984	788	98d5dd6c09fa093e791e3c18a9526859.exe	WScript.exe
PID 788 wrote to memory of 1984	788	98d5dd6c09fa093e791e3c18a9526859.exe	WScript.exe
PID 1984 wrote to memory of 1788	1984	WScript.exe	cmd.exe
PID 1984 wrote to memory of 1788	1984	WScript.exe	cmd.exe
PID 1984 wrote to memory of 1788	1984	WScript.exe	cmd.exe
PID 1984 wrote to memory of 1788	1984	WScript.exe	cmd.exe
PID 1788 wrote to memory of 1700	1788	cmd.exe	WMIC.exe
PID 1788 wrote to memory of 1700	1788	cmd.exe	WMIC.exe
PID 1788 wrote to memory of 1700	1788	cmd.exe	WMIC.exe
PID 1788 wrote to memory of 1700	1788	cmd.exe	WMIC.exe
PID 1788 wrote to memory of 1820	1788	cmd.exe	taskkill.exe
PID 1788 wrote to memory of 1820	1788	cmd.exe	taskkill.exe
PID 1788 wrote to memory of 1820	1788	cmd.exe	taskkill.exe
PID 1788 wrote to memory of 1820	1788	cmd.exe	taskkill.exe
PID 1788 wrote to memory of 908	1788	cmd.exe	WMIC.exe
PID 1788 wrote to memory of 908	1788	cmd.exe	WMIC.exe
PID 1788 wrote to memory of 908	1788	cmd.exe	WMIC.exe
PID 1788 wrote to memory of 908	1788	cmd.exe	WMIC.exe
PID 1788 wrote to memory of 564	1788	cmd.exe	PING.EXE
PID 1788 wrote to memory of 564	1788	cmd.exe	PING.EXE
PID 1788 wrote to memory of 564	1788	cmd.exe	PING.EXE
PID 1788 wrote to memory of 564	1788	cmd.exe	PING.EXE
PID 1788 wrote to memory of 1644	1788	cmd.exe	WScript.exe
PID 1788 wrote to memory of 1644	1788	cmd.exe	WScript.exe
PID 1788 wrote to memory of 1644	1788	cmd.exe	WScript.exe
PID 1788 wrote to memory of 1644	1788	cmd.exe	WScript.exe
PID 1788 wrote to memory of 1672	1788	cmd.exe	PING.EXE
PID 1788 wrote to memory of 1672	1788	cmd.exe	PING.EXE
PID 1788 wrote to memory of 1672	1788	cmd.exe	PING.EXE
PID 1788 wrote to memory of 1672	1788	cmd.exe	PING.EXE
PID 1788 wrote to memory of 1796	1788	cmd.exe	cmd.exe
PID 1788 wrote to memory of 1796	1788	cmd.exe	cmd.exe
PID 1788 wrote to memory of 1796	1788	cmd.exe	cmd.exe
PID 1788 wrote to memory of 1796	1788	cmd.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\98d5dd6c09fa093e791e3c18a9526859.exe
"C:\Users\Admin\AppData\Local\Temp\98d5dd6c09fa093e791e3c18a9526859.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:788

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\updateW\java.vbs"
2⤵
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\updateW\windowsapp.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic process where ExecutablePath='C:\\Windows (x86)\\explorer.exe' delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1700

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM xmrig.exe
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1820

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic process where name='xmrig.exe' delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:908

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
4⤵
- Runs ping.exe
PID:564

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\updateW\upd3.vbs"
4⤵
PID:1644

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
4⤵
- Runs ping.exe
PID:1672

C:\Windows\SysWOW64\cmd.exe
cmd /c del "C:\Users\Admin\AppData\Local\Temp\updateW\windowsapp.bat"
4⤵
PID:1796

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\updateW\java.vbs
MD5
399bcbd390bbead43b52e37d6995a2c0

SHA1
e0d3cba8a70da9f354cb7ee475d3d38881cadd87

SHA256
61e69b8bed7505b56f5c6748681dfca443e5e65a7981d043a84d0f696eae5574

SHA512
c174506c51e6e46510655ae1750f4f2626d570471e8a8155182bec5881bc32507ce06b5d46f9b7084194e02769f15f40d46139aa3addcad5738ade273e72fa13

Download Submit
C:\Users\Admin\AppData\Local\Temp\updateW\upd3.vbs
MD5
05d48b39d8e8e92a13256d9b3cb79cce

SHA1
cd1f23ccb928132ec9ef415e12a739edb72149cb

SHA256
01889de4022fd096e6197cf9ea6b7082da191b6053a048be0e487c4640cfdff6

SHA512
04680e0e7484c176f7db73af54db87d11a82ae238c0f43a2d27354d30a4e045f70b988c9a66f8ec76901797569ca45bf669d4a59d70624a1232555c23111230e

Download Submit
C:\Users\Admin\AppData\Local\Temp\updateW\windowsapp.bat
MD5
9e068fba166fc4dc6fdd7059a71cbda0

SHA1
2ec36119a97772fcebb8efbfab8b00a26c7519b3

SHA256
deaa0392f0e31151176926cdbb853ad39771f44019dbd8d7c3b1e65b4ee09770

SHA512
ef95bee35fcf69a2c9dc8534a24df0c58420d68cb793e51f7a09a7366033b47e50286b4d191e2e591d34c9addcab17c4a2b827cfde8bfdabc1f2136d95ae8730

Download Submit
memory/564-69-0x0000000000000000-mapping.dmp

Download
memory/788-60-0x0000000075551000-0x0000000075553000-memory.dmp

Filesize
8KB

Download
memory/908-68-0x0000000000000000-mapping.dmp

Download
memory/1644-72-0x0000000000000000-mapping.dmp

Download
memory/1672-73-0x0000000000000000-mapping.dmp

Download
memory/1700-66-0x0000000000000000-mapping.dmp

Download
memory/1788-65-0x0000000000000000-mapping.dmp

Download
memory/1796-75-0x0000000000000000-mapping.dmp

Download
memory/1820-67-0x0000000000000000-mapping.dmp

Download
memory/1984-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing