5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b

General

Target

5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe
Size

321KB
MD5

b3dfddeb4e98e313447abeba696138a9
SHA1

e896f357b169a6fcab180aa5c7ed2ef05b21fd0c
SHA256

5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b
SHA512

7a2db2991c2fd31c40b1c4406532a8eefae777525e3a4cb28815bf29b5f3a0f3fbe17cc433c065c7b31a8f7f74d55c592841e48bc8e81999a3ada18a17e8c76d

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1440	5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe

Deletes itself 1 IoCs

pid	Process
1716	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
1508	5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe
1508	5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
364	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1508	5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 1440	1508	5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe	27
PID 1508 wrote to memory of 1440	1508	5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe	27
PID 1508 wrote to memory of 1440	1508	5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe	27
PID 1508 wrote to memory of 1440	1508	5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe	27
PID 1508 wrote to memory of 1716	1508	5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe	28
PID 1508 wrote to memory of 1716	1508	5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe	28
PID 1508 wrote to memory of 1716	1508	5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe	28
PID 1508 wrote to memory of 1716	1508	5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe	28
PID 1716 wrote to memory of 364	1716	cmd.exe	30
PID 1716 wrote to memory of 364	1716	cmd.exe	30
PID 1716 wrote to memory of 364	1716	cmd.exe	30
PID 1716 wrote to memory of 364	1716	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe
"C:\Users\Admin\AppData\Local\Temp\5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Users\Admin\AppData\Local\Temp\5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b\5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe
  "C:\Users\Admin\AppData\Local\Temp\5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b\5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe"
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 1000
    3⤵
    - Runs ping.exe
    PID:364

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b\5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe

Filesize
321KB

MD5
b3dfddeb4e98e313447abeba696138a9

SHA1
e896f357b169a6fcab180aa5c7ed2ef05b21fd0c

SHA256
5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b

SHA512
7a2db2991c2fd31c40b1c4406532a8eefae777525e3a4cb28815bf29b5f3a0f3fbe17cc433c065c7b31a8f7f74d55c592841e48bc8e81999a3ada18a17e8c76d

Download Submit
C:\Users\Admin\AppData\Local\Temp\5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b\5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe

Filesize
321KB

MD5
b3dfddeb4e98e313447abeba696138a9

SHA1
e896f357b169a6fcab180aa5c7ed2ef05b21fd0c

SHA256
5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b

SHA512
7a2db2991c2fd31c40b1c4406532a8eefae777525e3a4cb28815bf29b5f3a0f3fbe17cc433c065c7b31a8f7f74d55c592841e48bc8e81999a3ada18a17e8c76d

Download Submit
\Users\Admin\AppData\Local\Temp\5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b\5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe

Filesize
321KB

MD5
b3dfddeb4e98e313447abeba696138a9

SHA1
e896f357b169a6fcab180aa5c7ed2ef05b21fd0c

SHA256
5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b

SHA512
7a2db2991c2fd31c40b1c4406532a8eefae777525e3a4cb28815bf29b5f3a0f3fbe17cc433c065c7b31a8f7f74d55c592841e48bc8e81999a3ada18a17e8c76d

Download Submit
\Users\Admin\AppData\Local\Temp\5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b\5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe

Filesize
321KB

MD5
b3dfddeb4e98e313447abeba696138a9

SHA1
e896f357b169a6fcab180aa5c7ed2ef05b21fd0c

SHA256
5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b

SHA512
7a2db2991c2fd31c40b1c4406532a8eefae777525e3a4cb28815bf29b5f3a0f3fbe17cc433c065c7b31a8f7f74d55c592841e48bc8e81999a3ada18a17e8c76d

Download Submit
memory/1440-63-0x0000000074DB0000-0x000000007535B000-memory.dmp

Filesize
5.7MB

Download
memory/1508-54-0x0000000075D41000-0x0000000075D43000-memory.dmp

Filesize
8KB

Download
memory/1508-55-0x0000000074DB0000-0x000000007535B000-memory.dmp

Filesize
5.7MB

Download
memory/1508-56-0x0000000074DB0000-0x000000007535B000-memory.dmp

Filesize
5.7MB

Download
memory/1508-65-0x0000000074DB0000-0x000000007535B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing