c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534

General

Target

c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
Size

7KB
MD5

34560fe55cedf502185ee393c9a7cbad
SHA1

8f889c0dfd81cc45b7c1ed7e02c2ac218bdd1b88
SHA256

c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534
SHA512

45837ddb402d5c1ecca90068d439f9216b9efae08b49f887c5e2ee8754ff9acb14aea2aa7cd705d5f95ba1e8c4069dd87ff5dddcf6caee9b71d66dfbd060f382
SSDEEP

96:cFGhXELMdV2Y2+8U2km+H9DSb+cEFaNxcJPg08aQXZ0MpJ5fzNt:cFeX+aV25+92km+q+TFa1zac5J

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Network List Service = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe"	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe

pid	process
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe

description pid process

Token: SeDebugPrivilege 5004 c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe

description	pid	process
Token: SeDebugPrivilege	5004	c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe

C:\Users\Admin\AppData\Local\Temp\c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe
"C:\Users\Admin\AppData\Local\Temp\c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5004-132-0x0000000074860000-0x0000000074E11000-memory.dmp

Filesize
5.7MB

Download
memory/5004-133-0x0000000074860000-0x0000000074E11000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing