9830f63ebad1f1317456e9eaa7df86bf4da592da962c9e20d27968b6cfd85607

General

Target

9830f63ebad1f1317456e9eaa7df86bf4da592da962c9e20d27968b6cfd85607.exe
Size

336KB
MD5

628ec815037575517717a42056b30790
SHA1

cd2c8eb44deda4088d0c377dc8bbce5d2940db6c
SHA256

9830f63ebad1f1317456e9eaa7df86bf4da592da962c9e20d27968b6cfd85607
SHA512

3f0c5c1345ac63d1bca30dbe34629bddc617f59234190da9208e88f745bdceb11b4ac1113ac063adfe7624d7a52d4735a0f2e3ed25a06429d75a22459da11f95
SSDEEP

1536:ja2UssW/RGl5657uYQRedx+g/8+LNKI4pTk8JnWwTYR2Y+ycQTc4KZ06tPgK/sa5:j+lW+GOskh+lIL35FgVrhi9mOr

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1916	714.exe
1072	494.exe
1740	wnetwatcher.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
1964	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\898dc05219f75f5eecc8fafc0d47e0c4.exe	wnetwatcher.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\898dc05219f75f5eecc8fafc0d47e0c4.exe	wnetwatcher.exe

Loads dropped DLL 1 IoCs

pid	Process
1072	494.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\898dc05219f75f5eecc8fafc0d47e0c4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\wnetwatcher.exe\" .."	wnetwatcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\898dc05219f75f5eecc8fafc0d47e0c4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\wnetwatcher.exe\" .."	wnetwatcher.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1740	wnetwatcher.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1740	wnetwatcher.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1916	1788	9830f63ebad1f1317456e9eaa7df86bf4da592da962c9e20d27968b6cfd85607.exe	28
PID 1788 wrote to memory of 1916	1788	9830f63ebad1f1317456e9eaa7df86bf4da592da962c9e20d27968b6cfd85607.exe	28
PID 1788 wrote to memory of 1916	1788	9830f63ebad1f1317456e9eaa7df86bf4da592da962c9e20d27968b6cfd85607.exe	28
PID 1916 wrote to memory of 1072	1916	714.exe	29
PID 1916 wrote to memory of 1072	1916	714.exe	29
PID 1916 wrote to memory of 1072	1916	714.exe	29
PID 1916 wrote to memory of 1072	1916	714.exe	29
PID 1072 wrote to memory of 1740	1072	494.exe	30
PID 1072 wrote to memory of 1740	1072	494.exe	30
PID 1072 wrote to memory of 1740	1072	494.exe	30
PID 1072 wrote to memory of 1740	1072	494.exe	30
PID 1740 wrote to memory of 1964	1740	wnetwatcher.exe	31
PID 1740 wrote to memory of 1964	1740	wnetwatcher.exe	31
PID 1740 wrote to memory of 1964	1740	wnetwatcher.exe	31
PID 1740 wrote to memory of 1964	1740	wnetwatcher.exe	31

C:\Users\Admin\AppData\Local\Temp\9830f63ebad1f1317456e9eaa7df86bf4da592da962c9e20d27968b6cfd85607.exe
"C:\Users\Admin\AppData\Local\Temp\9830f63ebad1f1317456e9eaa7df86bf4da592da962c9e20d27968b6cfd85607.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Users\Admin\AppData\Local\Temp\714.exe
  C:\Users\Admin\AppData\Local\Temp\714.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Users\Admin\AppData\Local\Temp\494.exe
    C:\Users\Admin\AppData\Local\Temp\494.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1072
  - - C:\Users\Admin\AppData\Local\Temp\wnetwatcher.exe
      "C:\Users\Admin\AppData\Local\Temp\wnetwatcher.exe"
      4⤵
      Executes dropped EXE
      Drops startup file
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1740
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\wnetwatcher.exe" "wnetwatcher.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        
        PID:1964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\494.exe

Filesize
43KB

MD5
7003c15102cfaba7e95c6bd3f24cc6b4

SHA1
44a261ac65196e588392f116968ec7e7fd4988ed

SHA256
c739b2cbbefa3a8715cd3ec84374dbb03b334dbfe3698db4023a33fc2b8f6fd5

SHA512
8f8321de8f97c6af710f3e443fc8083f14b921490f2d38cb3fd267a0ebf8eeaaaa4aa36976d54e55f8e2f60b40b9188b31252cf360dfdbcbadf85c17cad5a089

Download Submit
C:\Users\Admin\AppData\Local\Temp\494.exe

Filesize
43KB

MD5
7003c15102cfaba7e95c6bd3f24cc6b4

SHA1
44a261ac65196e588392f116968ec7e7fd4988ed

SHA256
c739b2cbbefa3a8715cd3ec84374dbb03b334dbfe3698db4023a33fc2b8f6fd5

SHA512
8f8321de8f97c6af710f3e443fc8083f14b921490f2d38cb3fd267a0ebf8eeaaaa4aa36976d54e55f8e2f60b40b9188b31252cf360dfdbcbadf85c17cad5a089

Download Submit
C:\Users\Admin\AppData\Local\Temp\714.exe

Filesize
123KB

MD5
2d7b4ce5919ea6bfe7de874b94f02ce0

SHA1
db0211cb99a168f93eacda5eacdcaa63908941a0

SHA256
d31560e74fb91eab70da99c7566045184e30d5965bd3ecf993564ca93a72fa3a

SHA512
51b2720b4b047fbe5727bfce5183dfd33474fc86ae20bd6e785ff15791cdf0009a4297d2bb55b823820dc9bbccb5d17560b1dd4461d2f38c03ae2bcba0c0fa05

Download Submit
C:\Users\Admin\AppData\Local\Temp\714.exe

Filesize
123KB

MD5
2d7b4ce5919ea6bfe7de874b94f02ce0

SHA1
db0211cb99a168f93eacda5eacdcaa63908941a0

SHA256
d31560e74fb91eab70da99c7566045184e30d5965bd3ecf993564ca93a72fa3a

SHA512
51b2720b4b047fbe5727bfce5183dfd33474fc86ae20bd6e785ff15791cdf0009a4297d2bb55b823820dc9bbccb5d17560b1dd4461d2f38c03ae2bcba0c0fa05

Download Submit
C:\Users\Admin\AppData\Local\Temp\wnetwatcher.exe

Filesize
43KB

MD5
7003c15102cfaba7e95c6bd3f24cc6b4

SHA1
44a261ac65196e588392f116968ec7e7fd4988ed

SHA256
c739b2cbbefa3a8715cd3ec84374dbb03b334dbfe3698db4023a33fc2b8f6fd5

SHA512
8f8321de8f97c6af710f3e443fc8083f14b921490f2d38cb3fd267a0ebf8eeaaaa4aa36976d54e55f8e2f60b40b9188b31252cf360dfdbcbadf85c17cad5a089

Download Submit
C:\Users\Admin\AppData\Local\Temp\wnetwatcher.exe

Filesize
43KB

MD5
7003c15102cfaba7e95c6bd3f24cc6b4

SHA1
44a261ac65196e588392f116968ec7e7fd4988ed

SHA256
c739b2cbbefa3a8715cd3ec84374dbb03b334dbfe3698db4023a33fc2b8f6fd5

SHA512
8f8321de8f97c6af710f3e443fc8083f14b921490f2d38cb3fd267a0ebf8eeaaaa4aa36976d54e55f8e2f60b40b9188b31252cf360dfdbcbadf85c17cad5a089

Download Submit
\Users\Admin\AppData\Local\Temp\wnetwatcher.exe

Filesize
43KB

MD5
7003c15102cfaba7e95c6bd3f24cc6b4

SHA1
44a261ac65196e588392f116968ec7e7fd4988ed

SHA256
c739b2cbbefa3a8715cd3ec84374dbb03b334dbfe3698db4023a33fc2b8f6fd5

SHA512
8f8321de8f97c6af710f3e443fc8083f14b921490f2d38cb3fd267a0ebf8eeaaaa4aa36976d54e55f8e2f60b40b9188b31252cf360dfdbcbadf85c17cad5a089

Download Submit
memory/1072-62-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download
memory/1072-63-0x0000000074350000-0x00000000748FB000-memory.dmp

Filesize
5.7MB

Download
memory/1072-70-0x0000000074350000-0x00000000748FB000-memory.dmp

Filesize
5.7MB

Download
memory/1740-71-0x0000000074350000-0x00000000748FB000-memory.dmp

Filesize
5.7MB

Download
memory/1740-73-0x0000000074350000-0x00000000748FB000-memory.dmp

Filesize
5.7MB

Download
memory/1788-54-0x00000000002F0000-0x000000000034A000-memory.dmp

Filesize
360KB

Download
memory/1916-58-0x0000000000F50000-0x0000000000F76000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing