2317748ad551dc2135863e38a626dcfa0447b27607487fc1cd0d7d413e7af302

General

Target

2317748ad551dc2135863e38a626dcfa0447b27607487fc1cd0d7d413e7af302.exe
Size

1.9MB
MD5

0d7f648049f93b23add982c5361e8b77
SHA1

081871f14738a904bbf188cb19ba7813d7133043
SHA256

2317748ad551dc2135863e38a626dcfa0447b27607487fc1cd0d7d413e7af302
SHA512

18672bec58b0d1ef84b11ead219bdb28f04a5281fb3df071c3e45397f81bfb7b5f5539285bc809f90de487fd60c8f89ba3d70559c3310565b15b92d9a78ab503
SSDEEP

49152:UnXMI/Osb1cZDuEr2e+qm/mpPAklOU/p6HU2ua0k0p6nYxC:SXMIGM+h2tqm/wYkAwqOvpoYM

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Protector-tnof.exe

pid process

1052 Protector-tnof.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

572 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

2317748ad551dc2135863e38a626dcfa0447b27607487fc1cd0d7d413e7af302.exe

pid process

1252 2317748ad551dc2135863e38a626dcfa0447b27607487fc1cd0d7d413e7af302.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1052	Protector-tnof.exe

pid	process
572	cmd.exe

pid	process
1252	2317748ad551dc2135863e38a626dcfa0447b27607487fc1cd0d7d413e7af302.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

2317748ad551dc2135863e38a626dcfa0447b27607487fc1cd0d7d413e7af302.exeProtector-tnof.exe

description	pid	process
Token: SeDebugPrivilege	1252	2317748ad551dc2135863e38a626dcfa0447b27607487fc1cd0d7d413e7af302.exe
Token: SeShutdownPrivilege	1252	2317748ad551dc2135863e38a626dcfa0447b27607487fc1cd0d7d413e7af302.exe
Token: SeDebugPrivilege	1052	Protector-tnof.exe
Token: SeShutdownPrivilege	1052	Protector-tnof.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

2317748ad551dc2135863e38a626dcfa0447b27607487fc1cd0d7d413e7af302.exeProtector-tnof.exe

pid process

1252 2317748ad551dc2135863e38a626dcfa0447b27607487fc1cd0d7d413e7af302.exe
1052 Protector-tnof.exe

pid	process
1252	2317748ad551dc2135863e38a626dcfa0447b27607487fc1cd0d7d413e7af302.exe
1052	Protector-tnof.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

2317748ad551dc2135863e38a626dcfa0447b27607487fc1cd0d7d413e7af302.exe

description	pid	process	target process
PID 1252 wrote to memory of 1052	1252	2317748ad551dc2135863e38a626dcfa0447b27607487fc1cd0d7d413e7af302.exe	Protector-tnof.exe
PID 1252 wrote to memory of 1052	1252	2317748ad551dc2135863e38a626dcfa0447b27607487fc1cd0d7d413e7af302.exe	Protector-tnof.exe
PID 1252 wrote to memory of 1052	1252	2317748ad551dc2135863e38a626dcfa0447b27607487fc1cd0d7d413e7af302.exe	Protector-tnof.exe
PID 1252 wrote to memory of 1052	1252	2317748ad551dc2135863e38a626dcfa0447b27607487fc1cd0d7d413e7af302.exe	Protector-tnof.exe
PID 1252 wrote to memory of 572	1252	2317748ad551dc2135863e38a626dcfa0447b27607487fc1cd0d7d413e7af302.exe	cmd.exe
PID 1252 wrote to memory of 572	1252	2317748ad551dc2135863e38a626dcfa0447b27607487fc1cd0d7d413e7af302.exe	cmd.exe
PID 1252 wrote to memory of 572	1252	2317748ad551dc2135863e38a626dcfa0447b27607487fc1cd0d7d413e7af302.exe	cmd.exe
PID 1252 wrote to memory of 572	1252	2317748ad551dc2135863e38a626dcfa0447b27607487fc1cd0d7d413e7af302.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\2317748ad551dc2135863e38a626dcfa0447b27607487fc1cd0d7d413e7af302.exe
"C:\Users\Admin\AppData\Local\Temp\2317748ad551dc2135863e38a626dcfa0447b27607487fc1cd0d7d413e7af302.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252

C:\Users\Admin\AppData\Roaming\Protector-tnof.exe
C:\Users\Admin\AppData\Roaming\Protector-tnof.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1052

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\231774~1.EXE" >> NUL
2⤵
- Deletes itself
PID:572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Protector-tnof.exe

Filesize
1.9MB

MD5
0d7f648049f93b23add982c5361e8b77

SHA1
081871f14738a904bbf188cb19ba7813d7133043

SHA256
2317748ad551dc2135863e38a626dcfa0447b27607487fc1cd0d7d413e7af302

SHA512
18672bec58b0d1ef84b11ead219bdb28f04a5281fb3df071c3e45397f81bfb7b5f5539285bc809f90de487fd60c8f89ba3d70559c3310565b15b92d9a78ab503

Download Submit
C:\Users\Admin\AppData\Roaming\Protector-tnof.exe

Filesize
1.9MB

MD5
0d7f648049f93b23add982c5361e8b77

SHA1
081871f14738a904bbf188cb19ba7813d7133043

SHA256
2317748ad551dc2135863e38a626dcfa0447b27607487fc1cd0d7d413e7af302

SHA512
18672bec58b0d1ef84b11ead219bdb28f04a5281fb3df071c3e45397f81bfb7b5f5539285bc809f90de487fd60c8f89ba3d70559c3310565b15b92d9a78ab503

Download Submit
\Users\Admin\AppData\Roaming\Protector-tnof.exe

Filesize
1.9MB

MD5
0d7f648049f93b23add982c5361e8b77

SHA1
081871f14738a904bbf188cb19ba7813d7133043

SHA256
2317748ad551dc2135863e38a626dcfa0447b27607487fc1cd0d7d413e7af302

SHA512
18672bec58b0d1ef84b11ead219bdb28f04a5281fb3df071c3e45397f81bfb7b5f5539285bc809f90de487fd60c8f89ba3d70559c3310565b15b92d9a78ab503

Download Submit
memory/572-65-0x0000000000000000-mapping.dmp

Download
memory/1052-59-0x0000000000000000-mapping.dmp

Download
memory/1052-63-0x0000000000400000-0x00000000007DC000-memory.dmp

Filesize
3.9MB

Download
memory/1052-64-0x0000000002000000-0x000000000205A000-memory.dmp

Filesize
360KB

Download
memory/1252-54-0x0000000075651000-0x0000000075653000-memory.dmp

Filesize
8KB

Download
memory/1252-55-0x0000000000400000-0x00000000007DC000-memory.dmp

Filesize
3.9MB

Download
memory/1252-56-0x0000000002000000-0x000000000205A000-memory.dmp

Filesize
360KB

Download
memory/1252-57-0x00000000033C0000-0x0000000003650000-memory.dmp

Filesize
2.6MB

Download
memory/1252-66-0x0000000000400000-0x00000000007DC000-memory.dmp

Filesize
3.9MB

Download

Analysis

Sharing