ffb3be6dd62f3dff6a879c8c3517e29cc6def1d675553efa45d40897295ec862

Analysis

Target

dfaeb668b7033674dc2743ef5f891b45.exe
Size

365KB
MD5

dfaeb668b7033674dc2743ef5f891b45
SHA1

9a1457c856d4f11a751a70b33294e297e7a24d60
SHA256

ffb3be6dd62f3dff6a879c8c3517e29cc6def1d675553efa45d40897295ec862
SHA512

1a2472ec076036c40e007d3572ad7db556e98a77f65108152b6ada6c3edef672adb5dacfe8c779f12582e9905ff887dd7a8df6b1a40fb2ca9619f39ac11a8415

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: RenamesItself 1 IoCs

Processes:

dfaeb668b7033674dc2743ef5f891b45.exe

pid process

2840 dfaeb668b7033674dc2743ef5f891b45.exe

pid	process
2840	dfaeb668b7033674dc2743ef5f891b45.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

dfaeb668b7033674dc2743ef5f891b45.exe

description	pid	process
Token: SeShutdownPrivilege	2840	dfaeb668b7033674dc2743ef5f891b45.exe
Token: SeCreatePagefilePrivilege	2840	dfaeb668b7033674dc2743ef5f891b45.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

dfaeb668b7033674dc2743ef5f891b45.exe

description	pid	process	target process
PID 2840 wrote to memory of 1124	2840	dfaeb668b7033674dc2743ef5f891b45.exe	cmd.exe
PID 2840 wrote to memory of 1124	2840	dfaeb668b7033674dc2743ef5f891b45.exe	cmd.exe
PID 2840 wrote to memory of 1124	2840	dfaeb668b7033674dc2743ef5f891b45.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\dfaeb668b7033674dc2743ef5f891b45.exe
"C:\Users\Admin\AppData\Local\Temp\dfaeb668b7033674dc2743ef5f891b45.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5Kb6Q0vQaoe0jtSE.bat" "
  2⤵
  PID:1124

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\5Kb6Q0vQaoe0jtSE.bat

MD5
c949c79a682ab38e7c736d2408c4366f

SHA1
c8f4430ed3a6d50410023bc189f3d76391f42564

SHA256
22a72b37c95f821739f07ee9c4fe9906f5e4fc412d1c55a29e5acccbb403e724

SHA512
49e45d7512a47a40619d72eb63779683a356b6c66b75bcb7a2ab326e2dc00145b411f807e329460b4fdfb9044e7111bd2d9ceb28f4a96866ede85dfea2db1b29

Download Submit
memory/1124-114-0x0000000000000000-mapping.dmp

Download