b214fc83001615764b06b39c855e3b744e9003bcad54422cc6104511b56903df

General

Target

b214fc83001615764b06b39c855e3b744e9003bcad54422cc6104511b56903df.exe
Size

16KB
MD5

f1aa0b9e168768249ce72feb0999b8ef
SHA1

ffa037198ba4d2163594cb7762d44447ae21a606
SHA256

b214fc83001615764b06b39c855e3b744e9003bcad54422cc6104511b56903df
SHA512

c79817e7954c743c74ed992827fcf7a125ab596e6760a38ee4b763ed944db56a0401ec5d7ae3531b8c8ee376b9750455d00ee8413e49b346ed1d3c2812a2797f
SSDEEP

192:COqhuaLgkGZLTBQ1Dymk7T9ByBiiN7w0qey+PFIqlv+lFFh0ZmWi2Je7AQ:COqhPOXBQc7toYiprqey+PF/9+zOJr

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1724 set thread context of 1476	1724	b214fc83001615764b06b39c855e3b744e9003bcad54422cc6104511b56903df.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
880	powershell.exe
1724	b214fc83001615764b06b39c855e3b744e9003bcad54422cc6104511b56903df.exe
1724	b214fc83001615764b06b39c855e3b744e9003bcad54422cc6104511b56903df.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1724	b214fc83001615764b06b39c855e3b744e9003bcad54422cc6104511b56903df.exe
Token: SeDebugPrivilege	880	powershell.exe
Token: SeDebugPrivilege	1476	b214fc83001615764b06b39c855e3b744e9003bcad54422cc6104511b56903df.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 880	1724	b214fc83001615764b06b39c855e3b744e9003bcad54422cc6104511b56903df.exe	27
PID 1724 wrote to memory of 880	1724	b214fc83001615764b06b39c855e3b744e9003bcad54422cc6104511b56903df.exe	27
PID 1724 wrote to memory of 880	1724	b214fc83001615764b06b39c855e3b744e9003bcad54422cc6104511b56903df.exe	27
PID 1724 wrote to memory of 880	1724	b214fc83001615764b06b39c855e3b744e9003bcad54422cc6104511b56903df.exe	27
PID 1724 wrote to memory of 1476	1724	b214fc83001615764b06b39c855e3b744e9003bcad54422cc6104511b56903df.exe	30
PID 1724 wrote to memory of 1476	1724	b214fc83001615764b06b39c855e3b744e9003bcad54422cc6104511b56903df.exe	30
PID 1724 wrote to memory of 1476	1724	b214fc83001615764b06b39c855e3b744e9003bcad54422cc6104511b56903df.exe	30
PID 1724 wrote to memory of 1476	1724	b214fc83001615764b06b39c855e3b744e9003bcad54422cc6104511b56903df.exe	30
PID 1724 wrote to memory of 1476	1724	b214fc83001615764b06b39c855e3b744e9003bcad54422cc6104511b56903df.exe	30
PID 1724 wrote to memory of 1476	1724	b214fc83001615764b06b39c855e3b744e9003bcad54422cc6104511b56903df.exe	30
PID 1724 wrote to memory of 1476	1724	b214fc83001615764b06b39c855e3b744e9003bcad54422cc6104511b56903df.exe	30
PID 1724 wrote to memory of 1476	1724	b214fc83001615764b06b39c855e3b744e9003bcad54422cc6104511b56903df.exe	30
PID 1724 wrote to memory of 1476	1724	b214fc83001615764b06b39c855e3b744e9003bcad54422cc6104511b56903df.exe	30

C:\Users\Admin\AppData\Local\Temp\b214fc83001615764b06b39c855e3b744e9003bcad54422cc6104511b56903df.exe
"C:\Users\Admin\AppData\Local\Temp\b214fc83001615764b06b39c855e3b744e9003bcad54422cc6104511b56903df.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANgA4AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:880
- C:\Users\Admin\AppData\Local\Temp\b214fc83001615764b06b39c855e3b744e9003bcad54422cc6104511b56903df.exe
  C:\Users\Admin\AppData\Local\Temp\b214fc83001615764b06b39c855e3b744e9003bcad54422cc6104511b56903df.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1476

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/880-62-0x000000006F160000-0x000000006F70B000-memory.dmp

Filesize
5.7MB

Download
memory/880-61-0x000000006F160000-0x000000006F70B000-memory.dmp

Filesize
5.7MB

Download
memory/880-60-0x000000006F160000-0x000000006F70B000-memory.dmp

Filesize
5.7MB

Download
memory/1476-66-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1476-79-0x0000000004CE0000-0x0000000004D34000-memory.dmp

Filesize
336KB

Download
memory/1476-78-0x00000000043B0000-0x00000000043FC000-memory.dmp

Filesize
304KB

Download
memory/1476-63-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1476-64-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1476-77-0x0000000000A90000-0x0000000000AE4000-memory.dmp

Filesize
336KB

Download
memory/1476-67-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1476-68-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1476-75-0x00000000006F0000-0x0000000000746000-memory.dmp

Filesize
344KB

Download
memory/1476-71-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1476-73-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1476-74-0x0000000004300000-0x00000000043AE000-memory.dmp

Filesize
696KB

Download
memory/1724-57-0x0000000004D10000-0x0000000004DA2000-memory.dmp

Filesize
584KB

Download
memory/1724-54-0x0000000000DF0000-0x0000000000DFA000-memory.dmp

Filesize
40KB

Download
memory/1724-55-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download
memory/1724-56-0x0000000008B70000-0x0000000008C9E000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing