1485ef0c179d60a8a62731bcfaf6e14e519becf479300223cca3be415d723e1d

General

Target

system.exe
Size

171KB
MD5

223b16194882202508eb561542596b24
SHA1

b166b6c9b8e92563314d3d7e360b887bab48e8b4
SHA256

918bdb78e8219893c11138fb33e7542c76991a23cc34098d7f7d608810e6d3b7
SHA512

82845a126588238f02ea8767c484d0abf47080bae35fe7373eecb94e84b8b171fc47358684879735d81e2d7b45eafad39d27385e6ae32986ec55b16d9c42e2c9

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 16 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\7zSCDAB.tmp\Downloads\desktop.ini	system.exe
File created	C:\Users\Admin\AppData\Local\Temp\7zSCDAB.tmp\Documents\desktop.ini	system.exe
File created	C:\Users\Admin\AppData\Local\Temp\7zSCDAB.tmp\Downloads\desktop.ini	system.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\7zSCDAB.tmp\Desktop\desktop.ini	system.exe
File created	C:\Users\Admin\AppData\Local\Temp\7zSCDAB.tmp\Libraries\desktop.ini	system.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\7zSCDAB.tmp\Libraries\desktop.ini	system.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\7zSCDAB.tmp\Documents\desktop.ini	system.exe
File created	C:\Users\Admin\AppData\Local\Temp\7zSCDAB.tmp\Videos\desktop.ini	system.exe
File created	C:\Users\Admin\AppData\Local\Temp\7zSCDAB.tmp\Desktop\desktop.ini	system.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\7zSCDAB.tmp\Music\desktop.ini	system.exe
File created	C:\Users\Admin\AppData\Local\Temp\7zSCDAB.tmp\Pictures\desktop.ini	system.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\7zSCDAB.tmp\Videos\desktop.ini	system.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\7zSCDAB.tmp\desktop.ini	system.exe
File created	C:\Users\Admin\AppData\Local\Temp\7zSCDAB.tmp\Music\desktop.ini	system.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\7zSCDAB.tmp\Pictures\desktop.ini	system.exe
File created	C:\Users\Admin\AppData\Local\Temp\7zSCDAB.tmp\desktop.ini	system.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
580	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	580	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 576	960	system.exe	27
PID 960 wrote to memory of 576	960	system.exe	27
PID 960 wrote to memory of 576	960	system.exe	27
PID 960 wrote to memory of 576	960	system.exe	27
PID 576 wrote to memory of 696	576	cmd.exe	29
PID 576 wrote to memory of 696	576	cmd.exe	29
PID 576 wrote to memory of 696	576	cmd.exe	29
PID 576 wrote to memory of 696	576	cmd.exe	29
PID 576 wrote to memory of 580	576	cmd.exe	30
PID 576 wrote to memory of 580	576	cmd.exe	30
PID 576 wrote to memory of 580	576	cmd.exe	30
PID 576 wrote to memory of 580	576	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\system.exe
"C:\Users\Admin\AppData\Local\Temp\system.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\7zSCDAB.tmp\system.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:576
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0x0 /f
    3⤵
    PID:696
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe New-NetFirewallRule -Name allowRemoteDesktop -DisplayName 'allow RemoteDesktop' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 3369
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/580-58-0x0000000002740000-0x0000000002741000-memory.dmp

Filesize
4KB

Download
memory/580-57-0x0000000073661000-0x0000000073662000-memory.dmp

Filesize
4KB

Download
memory/580-59-0x0000000073662000-0x0000000073664000-memory.dmp

Filesize
8KB

Download
memory/580-60-0x0000000002741000-0x0000000002742000-memory.dmp

Filesize
4KB

Download
memory/580-61-0x0000000002742000-0x0000000002744000-memory.dmp

Filesize
8KB

Download
memory/960-54-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing