711ca37e6c353fcf192069195f43ae03e3827c507bf86af2b620f678d11bfa5b

General

Target

711ca37e6c353fcf192069195f43ae03e3827c507bf86af2b620f678d11bfa5b.exe
Size

668KB
MD5

30a77da029ab5ccde2a95dfc5188621f
SHA1

513abf59e0954d1ec0a44b465ce1d0e03cc55de4
SHA256

711ca37e6c353fcf192069195f43ae03e3827c507bf86af2b620f678d11bfa5b
SHA512

73038b2e5e26cd85378bb11c56ca2c624c0f794d3cea1d08443290b0a9c892b48b761e47dd5e618e3d1d8cc5e2d39f51bfcd883af11186a9df3ff1f3ea04a7a2
SSDEEP

12288:PaeVQkTrvj4nZrYA6HO2kiurPjoU2Fh061hXM+UTPXoh5MD/XnjPE:PHQkTf4nZL2YZuhc+UjYh5MDfn

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
792	LocalTRjwlAshOl.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
764	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cfc74b2b4f3962793880a27d82809099.exe	LocalTRjwlAshOl.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cfc74b2b4f3962793880a27d82809099.exe	LocalTRjwlAshOl.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfc74b2b4f3962793880a27d82809099 = "\"C:\\Users\\Admin\\AppData\\LocalTRjwlAshOl.exe\" .."	LocalTRjwlAshOl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cfc74b2b4f3962793880a27d82809099 = "\"C:\\Users\\Admin\\AppData\\LocalTRjwlAshOl.exe\" .."	LocalTRjwlAshOl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
792	LocalTRjwlAshOl.exe
792	LocalTRjwlAshOl.exe
792	LocalTRjwlAshOl.exe
792	LocalTRjwlAshOl.exe
792	LocalTRjwlAshOl.exe
792	LocalTRjwlAshOl.exe
792	LocalTRjwlAshOl.exe
792	LocalTRjwlAshOl.exe
792	LocalTRjwlAshOl.exe
792	LocalTRjwlAshOl.exe
792	LocalTRjwlAshOl.exe
792	LocalTRjwlAshOl.exe
792	LocalTRjwlAshOl.exe
792	LocalTRjwlAshOl.exe
792	LocalTRjwlAshOl.exe
792	LocalTRjwlAshOl.exe
792	LocalTRjwlAshOl.exe
792	LocalTRjwlAshOl.exe
792	LocalTRjwlAshOl.exe
792	LocalTRjwlAshOl.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	792	LocalTRjwlAshOl.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 792	1476	711ca37e6c353fcf192069195f43ae03e3827c507bf86af2b620f678d11bfa5b.exe	27
PID 1476 wrote to memory of 792	1476	711ca37e6c353fcf192069195f43ae03e3827c507bf86af2b620f678d11bfa5b.exe	27
PID 1476 wrote to memory of 792	1476	711ca37e6c353fcf192069195f43ae03e3827c507bf86af2b620f678d11bfa5b.exe	27
PID 1476 wrote to memory of 792	1476	711ca37e6c353fcf192069195f43ae03e3827c507bf86af2b620f678d11bfa5b.exe	27
PID 792 wrote to memory of 764	792	LocalTRjwlAshOl.exe	29
PID 792 wrote to memory of 764	792	LocalTRjwlAshOl.exe	29
PID 792 wrote to memory of 764	792	LocalTRjwlAshOl.exe	29
PID 792 wrote to memory of 764	792	LocalTRjwlAshOl.exe	29

C:\Users\Admin\AppData\Local\Temp\711ca37e6c353fcf192069195f43ae03e3827c507bf86af2b620f678d11bfa5b.exe
"C:\Users\Admin\AppData\Local\Temp\711ca37e6c353fcf192069195f43ae03e3827c507bf86af2b620f678d11bfa5b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Users\Admin\AppData\LocalTRjwlAshOl.exe
  "C:\Users\Admin\AppData\LocalTRjwlAshOl.exe"
  2⤵
  - Executes dropped EXE
  - Drops startup file
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:792
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\LocalTRjwlAshOl.exe" "LocalTRjwlAshOl.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalTRjwlAshOl.exe

Filesize
419KB

MD5
8ea76646813f9df5b1f75adbf41a1ca8

SHA1
8e3dbfbbfbdeb36fbf3141e97b0208999bd58033

SHA256
2b069daf3ecb96d228d129c18c80d14d9c4f4621f87864da7b61f73d4dc25d68

SHA512
543148e6c5992f0ea9fdc8c29042d5e037249b3977c7e02b22932dc053b1eef538537b36b14eeac4e28fc2b7118c77fc15d4bf348406cae32555bf2f8f3d0b13

Download Submit
C:\Users\Admin\AppData\LocalTRjwlAshOl.exe

Filesize
419KB

MD5
8ea76646813f9df5b1f75adbf41a1ca8

SHA1
8e3dbfbbfbdeb36fbf3141e97b0208999bd58033

SHA256
2b069daf3ecb96d228d129c18c80d14d9c4f4621f87864da7b61f73d4dc25d68

SHA512
543148e6c5992f0ea9fdc8c29042d5e037249b3977c7e02b22932dc053b1eef538537b36b14eeac4e28fc2b7118c77fc15d4bf348406cae32555bf2f8f3d0b13

Download Submit
memory/792-62-0x0000000076701000-0x0000000076703000-memory.dmp

Filesize
8KB

Download
memory/792-58-0x0000000000570000-0x00000000005C8000-memory.dmp

Filesize
352KB

Download
memory/792-63-0x0000000074DE0000-0x000000007538B000-memory.dmp

Filesize
5.7MB

Download
memory/792-65-0x0000000000570000-0x00000000005C8000-memory.dmp

Filesize
352KB

Download
memory/792-66-0x0000000000570000-0x00000000005C8000-memory.dmp

Filesize
352KB

Download
memory/792-64-0x0000000000570000-0x00000000005C8000-memory.dmp

Filesize
352KB

Download
memory/792-70-0x0000000074DE0000-0x000000007538B000-memory.dmp

Filesize
5.7MB

Download
memory/1476-61-0x0000000002270000-0x0000000002280000-memory.dmp

Filesize
64KB

Download
memory/1476-54-0x000007FEF49D0000-0x000007FEF53F3000-memory.dmp

Filesize
10.1MB

Download
memory/1476-55-0x000007FEFC391000-0x000007FEFC393000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing