480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d

General

Target

480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe
Size

464KB
MD5

2f43b42731259a1a5540bd527e7a8f13
SHA1

9abfc46ab5f9f00b0f067e8892af6c820f5bbb86
SHA256

480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d
SHA512

c31c089d6a5de34610274079789405d395403c966cf8ffd5ba8fdcf583d6c4d5c989dd4c10b771414fc58863aad33c9af832fb620990127fe52b194eb77bd7c9
SSDEEP

6144:4/XN0PDGsAk7PsA10deW7jPYuSsgtntJ:WQ5DsA10deWvPwsKt

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
840	480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe

Loads dropped DLL 3 IoCs

pid	Process
1712	480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe
780	dw20.exe
780	dw20.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1712 set thread context of 840	1712	480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe:ZONE.identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1712	480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe
1712	480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe
1712	480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1712	480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1248	1712	480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe	27
PID 1712 wrote to memory of 1248	1712	480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe	27
PID 1712 wrote to memory of 1248	1712	480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe	27
PID 1712 wrote to memory of 1248	1712	480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe	27
PID 1712 wrote to memory of 840	1712	480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe	29
PID 1712 wrote to memory of 840	1712	480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe	29
PID 1712 wrote to memory of 840	1712	480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe	29
PID 1712 wrote to memory of 840	1712	480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe	29
PID 1712 wrote to memory of 840	1712	480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe	29
PID 1712 wrote to memory of 840	1712	480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe	29
PID 1712 wrote to memory of 840	1712	480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe	29
PID 1712 wrote to memory of 840	1712	480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe	29
PID 1712 wrote to memory of 840	1712	480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe	29
PID 840 wrote to memory of 780	840	480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe	31
PID 840 wrote to memory of 780	840	480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe	31
PID 840 wrote to memory of 780	840	480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe	31
PID 840 wrote to memory of 780	840	480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe	31

C:\Users\Admin\AppData\Local\Temp\480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe
"C:\Users\Admin\AppData\Local\Temp\480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > "C:\Users\Admin\AppData\Local\Temp\480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe":ZONE.identifier & exit
  2⤵
  - NTFS ADS
  PID:1248
- C:\Users\Admin\AppData\Local\Temp\480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe
  "C:\Users\Admin\AppData\Local\Temp\480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:840
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 776
    3⤵
    - Loads dropped DLL
    PID:780

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe

Filesize
464KB

MD5
2f43b42731259a1a5540bd527e7a8f13

SHA1
9abfc46ab5f9f00b0f067e8892af6c820f5bbb86

SHA256
480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d

SHA512
c31c089d6a5de34610274079789405d395403c966cf8ffd5ba8fdcf583d6c4d5c989dd4c10b771414fc58863aad33c9af832fb620990127fe52b194eb77bd7c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe

Filesize
464KB

MD5
2f43b42731259a1a5540bd527e7a8f13

SHA1
9abfc46ab5f9f00b0f067e8892af6c820f5bbb86

SHA256
480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d

SHA512
c31c089d6a5de34610274079789405d395403c966cf8ffd5ba8fdcf583d6c4d5c989dd4c10b771414fc58863aad33c9af832fb620990127fe52b194eb77bd7c9

Download Submit
\Users\Admin\AppData\Local\Temp\480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe

Filesize
464KB

MD5
2f43b42731259a1a5540bd527e7a8f13

SHA1
9abfc46ab5f9f00b0f067e8892af6c820f5bbb86

SHA256
480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d

SHA512
c31c089d6a5de34610274079789405d395403c966cf8ffd5ba8fdcf583d6c4d5c989dd4c10b771414fc58863aad33c9af832fb620990127fe52b194eb77bd7c9

Download Submit
\Users\Admin\AppData\Local\Temp\480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe

Filesize
464KB

MD5
2f43b42731259a1a5540bd527e7a8f13

SHA1
9abfc46ab5f9f00b0f067e8892af6c820f5bbb86

SHA256
480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d

SHA512
c31c089d6a5de34610274079789405d395403c966cf8ffd5ba8fdcf583d6c4d5c989dd4c10b771414fc58863aad33c9af832fb620990127fe52b194eb77bd7c9

Download Submit
\Users\Admin\AppData\Local\Temp\480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d.exe

Filesize
464KB

MD5
2f43b42731259a1a5540bd527e7a8f13

SHA1
9abfc46ab5f9f00b0f067e8892af6c820f5bbb86

SHA256
480224732799d73f283cf449167b31a1e31eb4cf5244c4e2bc60e0f4a7db930d

SHA512
c31c089d6a5de34610274079789405d395403c966cf8ffd5ba8fdcf583d6c4d5c989dd4c10b771414fc58863aad33c9af832fb620990127fe52b194eb77bd7c9

Download Submit
memory/840-80-0x0000000074150000-0x00000000746FB000-memory.dmp

Filesize
5.7MB

Download
memory/840-78-0x0000000000070000-0x00000000000B6000-memory.dmp

Filesize
280KB

Download
memory/840-63-0x0000000000070000-0x00000000000B6000-memory.dmp

Filesize
280KB

Download
memory/840-85-0x0000000074150000-0x00000000746FB000-memory.dmp

Filesize
5.7MB

Download
memory/840-70-0x0000000000070000-0x00000000000B6000-memory.dmp

Filesize
280KB

Download
memory/840-61-0x0000000000070000-0x00000000000B6000-memory.dmp

Filesize
280KB

Download
memory/840-60-0x0000000000070000-0x00000000000B6000-memory.dmp

Filesize
280KB

Download
memory/840-68-0x0000000000070000-0x00000000000B6000-memory.dmp

Filesize
280KB

Download
memory/840-75-0x0000000000070000-0x00000000000B6000-memory.dmp

Filesize
280KB

Download
memory/1712-55-0x00000000741C0000-0x000000007476B000-memory.dmp

Filesize
5.7MB

Download
memory/1712-56-0x00000000741C0000-0x000000007476B000-memory.dmp

Filesize
5.7MB

Download
memory/1712-71-0x0000000000D65000-0x0000000000D76000-memory.dmp

Filesize
68KB

Download
memory/1712-69-0x00000000741C0000-0x000000007476B000-memory.dmp

Filesize
5.7MB

Download
memory/1712-54-0x0000000075771000-0x0000000075773000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing