dfd1bdc64a8ac12c530593077e9bc675a428d0e976cca7ac361cb3e78da72c07

General

Target

dfd1bdc64a8ac12c530593077e9bc675a428d0e976cca7ac361cb3e78da72c07.exe
Size

273KB
MD5

9a04fe43112599664eccd2d07f47d8de
SHA1

b5d08eaf2df5103cc6789b7b8e31bbda97c72581
SHA256

dfd1bdc64a8ac12c530593077e9bc675a428d0e976cca7ac361cb3e78da72c07
SHA512

2283ccdb72db5f645559ce8e1376adc1c71ea154aaaa20007188526be4b0462d7fb3a6e3bb696f462395d599a2b0bde5d33022bc8716eae45ffe916a55eee09b

Score

8^/10

evasion

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

chrome.exe

pid process

2016 chrome.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1664 netsh.exe
Drops file in Windows directory 1 IoCs

Processes:

dfd1bdc64a8ac12c530593077e9bc675a428d0e976cca7ac361cb3e78da72c07.exe

description ioc process

File created C:\Windows\chrome.exe dfd1bdc64a8ac12c530593077e9bc675a428d0e976cca7ac361cb3e78da72c07.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
2016	chrome.exe

pid	process
1664	netsh.exe

description	ioc	process
File created	C:\Windows\chrome.exe	dfd1bdc64a8ac12c530593077e9bc675a428d0e976cca7ac361cb3e78da72c07.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeDebugPrivilege	2016	chrome.exe
Token: 33	2016	chrome.exe
Token: SeIncBasePriorityPrivilege	2016	chrome.exe
Token: 33	2016	chrome.exe
Token: SeIncBasePriorityPrivilege	2016	chrome.exe
Token: 33	2016	chrome.exe
Token: SeIncBasePriorityPrivilege	2016	chrome.exe
Token: 33	2016	chrome.exe
Token: SeIncBasePriorityPrivilege	2016	chrome.exe
Token: 33	2016	chrome.exe
Token: SeIncBasePriorityPrivilege	2016	chrome.exe
Token: 33	2016	chrome.exe
Token: SeIncBasePriorityPrivilege	2016	chrome.exe
Token: 33	2016	chrome.exe
Token: SeIncBasePriorityPrivilege	2016	chrome.exe
Token: 33	2016	chrome.exe
Token: SeIncBasePriorityPrivilege	2016	chrome.exe
Token: 33	2016	chrome.exe
Token: SeIncBasePriorityPrivilege	2016	chrome.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

dfd1bdc64a8ac12c530593077e9bc675a428d0e976cca7ac361cb3e78da72c07.exechrome.exe

description	pid	process	target process
PID 1788 wrote to memory of 2016	1788	dfd1bdc64a8ac12c530593077e9bc675a428d0e976cca7ac361cb3e78da72c07.exe	chrome.exe
PID 1788 wrote to memory of 2016	1788	dfd1bdc64a8ac12c530593077e9bc675a428d0e976cca7ac361cb3e78da72c07.exe	chrome.exe
PID 1788 wrote to memory of 2016	1788	dfd1bdc64a8ac12c530593077e9bc675a428d0e976cca7ac361cb3e78da72c07.exe	chrome.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	netsh.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	netsh.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\dfd1bdc64a8ac12c530593077e9bc675a428d0e976cca7ac361cb3e78da72c07.exe
"C:\Users\Admin\AppData\Local\Temp\dfd1bdc64a8ac12c530593077e9bc675a428d0e976cca7ac361cb3e78da72c07.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\chrome.exe
"C:\Windows\chrome.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\system32\netsh.exe
netsh firewall add allowedprogram "C:\Windows\chrome.exe" "chrome.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:1664

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\chrome.exe
Filesize
273KB

MD5
9a04fe43112599664eccd2d07f47d8de

SHA1
b5d08eaf2df5103cc6789b7b8e31bbda97c72581

SHA256
dfd1bdc64a8ac12c530593077e9bc675a428d0e976cca7ac361cb3e78da72c07

SHA512
2283ccdb72db5f645559ce8e1376adc1c71ea154aaaa20007188526be4b0462d7fb3a6e3bb696f462395d599a2b0bde5d33022bc8716eae45ffe916a55eee09b

Download Submit
C:\Windows\chrome.exe
Filesize
273KB

MD5
9a04fe43112599664eccd2d07f47d8de

SHA1
b5d08eaf2df5103cc6789b7b8e31bbda97c72581

SHA256
dfd1bdc64a8ac12c530593077e9bc675a428d0e976cca7ac361cb3e78da72c07

SHA512
2283ccdb72db5f645559ce8e1376adc1c71ea154aaaa20007188526be4b0462d7fb3a6e3bb696f462395d599a2b0bde5d33022bc8716eae45ffe916a55eee09b

Download Submit
memory/1664-61-0x0000000000000000-mapping.dmp

Download
memory/1664-62-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Filesize
8KB

Download
memory/1788-54-0x000007FEF4700000-0x000007FEF5123000-memory.dmp

Filesize
10.1MB

Download
memory/1788-55-0x000007FEF3210000-0x000007FEF42A6000-memory.dmp

Filesize
16.6MB

Download
memory/2016-56-0x0000000000000000-mapping.dmp

Download
memory/2016-59-0x000007FEF4700000-0x000007FEF5123000-memory.dmp

Filesize
10.1MB

Download
memory/2016-60-0x000007FEF2FD0000-0x000007FEF4066000-memory.dmp

Filesize
16.6MB

Download

Analysis

Sharing