9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd

General

Target

9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Size

838KB
MD5

8df60822a766641407449591ff62a4da
SHA1

b6416ea5fc4ec725c618de93df6da923def7c6d4
SHA256

9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd
SHA512

a6833ed73b5615366311e2036592973582ef24265c51729f005fda9782cc187d0fabe1d9851069a63c6e74089f64f491bc8649b1fe69361cb43d4d26bb215e8a
SSDEEP

12288:tKdQiWU5jtE7tJH2B3mM1m0YUNUkFeSfzzqWA+X2E7UvnEsJQDnyZCBcqqx0V+rb:NiWB8njmPQDnyQrOIy

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe

description	pid	process
Token: SeDebugPrivilege	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: 33	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: SeIncBasePriorityPrivilege	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: 33	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: SeIncBasePriorityPrivilege	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: 33	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: SeIncBasePriorityPrivilege	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: 33	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: SeIncBasePriorityPrivilege	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: 33	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: SeIncBasePriorityPrivilege	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: 33	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: SeIncBasePriorityPrivilege	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: 33	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: SeIncBasePriorityPrivilege	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: 33	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: SeIncBasePriorityPrivilege	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: 33	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: SeIncBasePriorityPrivilege	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: 33	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: SeIncBasePriorityPrivilege	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: 33	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: SeIncBasePriorityPrivilege	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: 33	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: SeIncBasePriorityPrivilege	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: 33	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: SeIncBasePriorityPrivilege	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: 33	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: SeIncBasePriorityPrivilege	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: 33	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: SeIncBasePriorityPrivilege	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: 33	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: SeIncBasePriorityPrivilege	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: 33	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: SeIncBasePriorityPrivilege	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: 33	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: SeIncBasePriorityPrivilege	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: 33	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: SeIncBasePriorityPrivilege	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: 33	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: SeIncBasePriorityPrivilege	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: 33	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: SeIncBasePriorityPrivilege	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: 33	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: SeIncBasePriorityPrivilege	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: 33	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: SeIncBasePriorityPrivilege	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: 33	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: SeIncBasePriorityPrivilege	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: 33	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: SeIncBasePriorityPrivilege	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: 33	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: SeIncBasePriorityPrivilege	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: 33	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: SeIncBasePriorityPrivilege	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: 33	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: SeIncBasePriorityPrivilege	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: 33	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: SeIncBasePriorityPrivilege	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: 33	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: SeIncBasePriorityPrivilege	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: 33	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: SeIncBasePriorityPrivilege	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
Token: 33	1104	9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe

C:\Users\Admin\AppData\Local\Temp\9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe
"C:\Users\Admin\AppData\Local\Temp\9e8dfe7f9c4e2d2dba77bd52c4b513f9d17921dc5ab7a807aeee6ecdb61534cd.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1104-132-0x00000000006A0000-0x0000000000778000-memory.dmp

Filesize
864KB

Download
memory/1104-133-0x0000000005160000-0x00000000051FC000-memory.dmp

Filesize
624KB

Download
memory/1104-134-0x00000000057B0000-0x0000000005D54000-memory.dmp

Filesize
5.6MB

Download
memory/1104-135-0x0000000005200000-0x0000000005292000-memory.dmp

Filesize
584KB

Download
memory/1104-136-0x0000000005150000-0x000000000515A000-memory.dmp

Filesize
40KB

Download
memory/1104-137-0x0000000005700000-0x0000000005756000-memory.dmp

Filesize
344KB

Download

Analysis

Sharing