d60356e1e20d61f63feda4ebe0672d0e5fd89bcce3fcedfb90ae7ede89583447

General

Target

d60356e1e20d61f63feda4ebe0672d0e5fd89bcce3fcedfb90ae7ede89583447.exe
Size

1.5MB
MD5

ae4f43595c1019fdac27e82b6f999c55
SHA1

56ade9f0b74d41660b0057615c1408e40f67f7a7
SHA256

d60356e1e20d61f63feda4ebe0672d0e5fd89bcce3fcedfb90ae7ede89583447
SHA512

3119ffa56f3f50af1e807383c3243f7fa715ac6ad8e745565b5a98a5892f17493ec7b71be15889b3a9b7525e81e86639a6c4d5e08a5f97ad5992563b6c5328ce
SSDEEP

24576:Kl74D3tsEo+wIIrAI6nfKfXy/bEM9vbZ6gd1DhDUfKz8zZdl:ecRZpI6S/yTFd1Dd8zZL

Score

8^/10

persistence

Malware Config

Signatures

Creates new service(s) 1 TTPs
persistence

New Service
T1050

Drops file in System32 directory 4 IoCs

Processes:

d60356e1e20d61f63feda4ebe0672d0e5fd89bcce3fcedfb90ae7ede89583447.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu	d60356e1e20d61f63feda4ebe0672d0e5fd89bcce3fcedfb90ae7ede89583447.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	d60356e1e20d61f63feda4ebe0672d0e5fd89bcce3fcedfb90ae7ede89583447.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs	d60356e1e20d61f63feda4ebe0672d0e5fd89bcce3fcedfb90ae7ede89583447.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	d60356e1e20d61f63feda4ebe0672d0e5fd89bcce3fcedfb90ae7ede89583447.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

2012 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

pid	process
2012	sc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

d60356e1e20d61f63feda4ebe0672d0e5fd89bcce3fcedfb90ae7ede89583447.exe

pid	process
2000	d60356e1e20d61f63feda4ebe0672d0e5fd89bcce3fcedfb90ae7ede89583447.exe
2000	d60356e1e20d61f63feda4ebe0672d0e5fd89bcce3fcedfb90ae7ede89583447.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

d60356e1e20d61f63feda4ebe0672d0e5fd89bcce3fcedfb90ae7ede89583447.exenet.exe

description	pid	process	target process
PID 1748 wrote to memory of 2012	1748	d60356e1e20d61f63feda4ebe0672d0e5fd89bcce3fcedfb90ae7ede89583447.exe	sc.exe
PID 1748 wrote to memory of 2012	1748	d60356e1e20d61f63feda4ebe0672d0e5fd89bcce3fcedfb90ae7ede89583447.exe	sc.exe
PID 1748 wrote to memory of 2012	1748	d60356e1e20d61f63feda4ebe0672d0e5fd89bcce3fcedfb90ae7ede89583447.exe	sc.exe
PID 1748 wrote to memory of 2012	1748	d60356e1e20d61f63feda4ebe0672d0e5fd89bcce3fcedfb90ae7ede89583447.exe	sc.exe
PID 1748 wrote to memory of 1732	1748	d60356e1e20d61f63feda4ebe0672d0e5fd89bcce3fcedfb90ae7ede89583447.exe	net.exe
PID 1748 wrote to memory of 1732	1748	d60356e1e20d61f63feda4ebe0672d0e5fd89bcce3fcedfb90ae7ede89583447.exe	net.exe
PID 1748 wrote to memory of 1732	1748	d60356e1e20d61f63feda4ebe0672d0e5fd89bcce3fcedfb90ae7ede89583447.exe	net.exe
PID 1748 wrote to memory of 1732	1748	d60356e1e20d61f63feda4ebe0672d0e5fd89bcce3fcedfb90ae7ede89583447.exe	net.exe
PID 1732 wrote to memory of 1208	1732	net.exe	net1.exe
PID 1732 wrote to memory of 1208	1732	net.exe	net1.exe
PID 1732 wrote to memory of 1208	1732	net.exe	net1.exe
PID 1732 wrote to memory of 1208	1732	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\d60356e1e20d61f63feda4ebe0672d0e5fd89bcce3fcedfb90ae7ede89583447.exe
"C:\Users\Admin\AppData\Local\Temp\d60356e1e20d61f63feda4ebe0672d0e5fd89bcce3fcedfb90ae7ede89583447.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create "zipdrivers" binpath= "C:\Users\Admin\AppData\Local\Temp\d60356e1e20d61f63feda4ebe0672d0e5fd89bcce3fcedfb90ae7ede89583447.exe srv" start= "auto"
2⤵
- Launches sc.exe
PID:2012

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" start "zipdrivers"
2⤵
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start "zipdrivers"
3⤵
PID:1208

C:\Users\Admin\AppData\Local\Temp\d60356e1e20d61f63feda4ebe0672d0e5fd89bcce3fcedfb90ae7ede89583447.exe
C:\Users\Admin\AppData\Local\Temp\d60356e1e20d61f63feda4ebe0672d0e5fd89bcce3fcedfb90ae7ede89583447.exe srv
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

New Service

1

T1050

Privilege Escalation

New Service

1

T1050

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1208-60-0x0000000000000000-mapping.dmp

Download
memory/1732-59-0x0000000000000000-mapping.dmp

Download
memory/1748-55-0x0000000000400000-0x00000000006D5000-memory.dmp

Filesize
2.8MB

Download
memory/1748-54-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download
memory/1748-57-0x0000000000400000-0x00000000006D5000-memory.dmp

Filesize
2.8MB

Download
memory/1748-58-0x0000000000A10000-0x0000000000A20000-memory.dmp

Filesize
64KB

Download
memory/1748-63-0x0000000000400000-0x00000000006D5000-memory.dmp

Filesize
2.8MB

Download
memory/1748-64-0x0000000000A10000-0x0000000000A20000-memory.dmp

Filesize
64KB

Download
memory/2000-62-0x0000000000400000-0x00000000006D5000-memory.dmp

Filesize
2.8MB

Download
memory/2000-65-0x0000000000400000-0x00000000006D5000-memory.dmp

Filesize
2.8MB

Download
memory/2012-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads