84ade438ef66e6771445a3cc4fabf779aa6883ea01c39e99b2e0134defcc51ab

General

Target

84ade438ef66e6771445a3cc4fabf779aa6883ea01c39e99b2e0134defcc51ab.exe
Size

84KB
MD5

33e70b85a6b35f3dc4cfa5810572c728
SHA1

2ea035b18b318feb303d86884fecf7fb474ed8e8
SHA256

84ade438ef66e6771445a3cc4fabf779aa6883ea01c39e99b2e0134defcc51ab
SHA512

82bb5628f52551d87b743ea1b1e58bf7df363a447a4a1806e6cd9dc377a0671100d14232df239cdf4955f46f9729d817f748cbb5af992f0a6090fb25be61d016
SSDEEP

1536:Tz2LOAmYhzihenoFV8pcr3XQtHeddSJ/M+/bbQ5sXHxmHpTrTytTKmIaaaM/8aav:Tz2LOAjQen0Ete4/Z/bbU6RkgNIaaaN/

Score

8^/10

evasion

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

local.exe

pid process

1116 local.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1212 netsh.exe

pid	process
1116	local.exe

pid	process
1212	netsh.exe

Loads dropped DLL 2 IoCs

Processes:

84ade438ef66e6771445a3cc4fabf779aa6883ea01c39e99b2e0134defcc51ab.exe

pid	process
1536	84ade438ef66e6771445a3cc4fabf779aa6883ea01c39e99b2e0134defcc51ab.exe
1536	84ade438ef66e6771445a3cc4fabf779aa6883ea01c39e99b2e0134defcc51ab.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

local.exe

pid process

1116 local.exe
1116 local.exe
1116 local.exe
1116 local.exe
1116 local.exe
1116 local.exe
1116 local.exe
1116 local.exe
1116 local.exe
1116 local.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

local.exe

description pid process

Token: SeDebugPrivilege 1116 local.exe

pid	process
1116	local.exe
1116	local.exe
1116	local.exe
1116	local.exe
1116	local.exe
1116	local.exe
1116	local.exe
1116	local.exe
1116	local.exe
1116	local.exe

description	pid	process
Token: SeDebugPrivilege	1116	local.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

84ade438ef66e6771445a3cc4fabf779aa6883ea01c39e99b2e0134defcc51ab.exelocal.exe

description	pid	process	target process
PID 1536 wrote to memory of 1116	1536	84ade438ef66e6771445a3cc4fabf779aa6883ea01c39e99b2e0134defcc51ab.exe	local.exe
PID 1536 wrote to memory of 1116	1536	84ade438ef66e6771445a3cc4fabf779aa6883ea01c39e99b2e0134defcc51ab.exe	local.exe
PID 1536 wrote to memory of 1116	1536	84ade438ef66e6771445a3cc4fabf779aa6883ea01c39e99b2e0134defcc51ab.exe	local.exe
PID 1536 wrote to memory of 1116	1536	84ade438ef66e6771445a3cc4fabf779aa6883ea01c39e99b2e0134defcc51ab.exe	local.exe
PID 1116 wrote to memory of 1212	1116	local.exe	netsh.exe
PID 1116 wrote to memory of 1212	1116	local.exe	netsh.exe
PID 1116 wrote to memory of 1212	1116	local.exe	netsh.exe
PID 1116 wrote to memory of 1212	1116	local.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\84ade438ef66e6771445a3cc4fabf779aa6883ea01c39e99b2e0134defcc51ab.exe
"C:\Users\Admin\AppData\Local\Temp\84ade438ef66e6771445a3cc4fabf779aa6883ea01c39e99b2e0134defcc51ab.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1536

C:\Users\Admin\AppData\Local\Temp\local.exe
"C:\Users\Admin\AppData\Local\Temp\local.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1116

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\local.exe" "local.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:1212

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\local.exe

Filesize
84KB

MD5
33e70b85a6b35f3dc4cfa5810572c728

SHA1
2ea035b18b318feb303d86884fecf7fb474ed8e8

SHA256
84ade438ef66e6771445a3cc4fabf779aa6883ea01c39e99b2e0134defcc51ab

SHA512
82bb5628f52551d87b743ea1b1e58bf7df363a447a4a1806e6cd9dc377a0671100d14232df239cdf4955f46f9729d817f748cbb5af992f0a6090fb25be61d016

Download Submit
C:\Users\Admin\AppData\Local\Temp\local.exe

Filesize
84KB

MD5
33e70b85a6b35f3dc4cfa5810572c728

SHA1
2ea035b18b318feb303d86884fecf7fb474ed8e8

SHA256
84ade438ef66e6771445a3cc4fabf779aa6883ea01c39e99b2e0134defcc51ab

SHA512
82bb5628f52551d87b743ea1b1e58bf7df363a447a4a1806e6cd9dc377a0671100d14232df239cdf4955f46f9729d817f748cbb5af992f0a6090fb25be61d016

Download Submit
\Users\Admin\AppData\Local\Temp\local.exe

Filesize
84KB

MD5
33e70b85a6b35f3dc4cfa5810572c728

SHA1
2ea035b18b318feb303d86884fecf7fb474ed8e8

SHA256
84ade438ef66e6771445a3cc4fabf779aa6883ea01c39e99b2e0134defcc51ab

SHA512
82bb5628f52551d87b743ea1b1e58bf7df363a447a4a1806e6cd9dc377a0671100d14232df239cdf4955f46f9729d817f748cbb5af992f0a6090fb25be61d016

Download Submit
\Users\Admin\AppData\Local\Temp\local.exe

Filesize
84KB

MD5
33e70b85a6b35f3dc4cfa5810572c728

SHA1
2ea035b18b318feb303d86884fecf7fb474ed8e8

SHA256
84ade438ef66e6771445a3cc4fabf779aa6883ea01c39e99b2e0134defcc51ab

SHA512
82bb5628f52551d87b743ea1b1e58bf7df363a447a4a1806e6cd9dc377a0671100d14232df239cdf4955f46f9729d817f748cbb5af992f0a6090fb25be61d016

Download Submit
memory/1116-59-0x0000000000000000-mapping.dmp

Download
memory/1116-64-0x0000000074EE0000-0x000000007548B000-memory.dmp

Filesize
5.7MB

Download
memory/1116-65-0x0000000074EE0000-0x000000007548B000-memory.dmp

Filesize
5.7MB

Download
memory/1212-66-0x0000000000000000-mapping.dmp

Download
memory/1536-54-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download
memory/1536-55-0x0000000074EE0000-0x000000007548B000-memory.dmp

Filesize
5.7MB

Download
memory/1536-56-0x0000000074EE0000-0x000000007548B000-memory.dmp

Filesize
5.7MB

Download
memory/1536-63-0x0000000074EE0000-0x000000007548B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing