abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c

General

Target

abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.exe
Size

274KB
MD5

545474e5e27aceaf673b1ae0e72bec43
SHA1

da2ee3a1fb37e3c7906b49f9816272d0020bbf7f
SHA256

abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c
SHA512

10a3188e1f93d43caacdbb6160e26ae1898b099da9b7edde4443637d8cd6b43235cae2b68b5732f7ced1bc098e51508b4aeb914a4e684e7d6b1892fd4f581f43
SSDEEP

6144:Iy9v17kwzVKndyPJMnDEXZBWqNpPB5leWe92TbpYViUbE+6kQL:597kAKndybnWqNpJ7e6TdiLB6kQ

Score

9^/10

ransomware spyware stealer

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Loads dropped DLL 1 IoCs

Processes:

abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.exe

pid process

2088 abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2088	abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.exe

description	pid	process	target process
PID 2088 set thread context of 4024	2088	abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.exe	abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.exe

pid	process
4024	abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.exe
4024	abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.exe
4024	abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.exe
4024	abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.exe

pid process

2088 abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.exe

pid	process
2088	abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.exeWMIC.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	4024	abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.exe
Token: SeIncreaseQuotaPrivilege	4760	WMIC.exe
Token: SeSecurityPrivilege	4760	WMIC.exe
Token: SeTakeOwnershipPrivilege	4760	WMIC.exe
Token: SeLoadDriverPrivilege	4760	WMIC.exe
Token: SeSystemProfilePrivilege	4760	WMIC.exe
Token: SeSystemtimePrivilege	4760	WMIC.exe
Token: SeProfSingleProcessPrivilege	4760	WMIC.exe
Token: SeIncBasePriorityPrivilege	4760	WMIC.exe
Token: SeCreatePagefilePrivilege	4760	WMIC.exe
Token: SeBackupPrivilege	4760	WMIC.exe
Token: SeRestorePrivilege	4760	WMIC.exe
Token: SeShutdownPrivilege	4760	WMIC.exe
Token: SeDebugPrivilege	4760	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4760	WMIC.exe
Token: SeRemoteShutdownPrivilege	4760	WMIC.exe
Token: SeUndockPrivilege	4760	WMIC.exe
Token: SeManageVolumePrivilege	4760	WMIC.exe
Token: 33	4760	WMIC.exe
Token: 34	4760	WMIC.exe
Token: 35	4760	WMIC.exe
Token: 36	4760	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4760	WMIC.exe
Token: SeSecurityPrivilege	4760	WMIC.exe
Token: SeTakeOwnershipPrivilege	4760	WMIC.exe
Token: SeLoadDriverPrivilege	4760	WMIC.exe
Token: SeSystemProfilePrivilege	4760	WMIC.exe
Token: SeSystemtimePrivilege	4760	WMIC.exe
Token: SeProfSingleProcessPrivilege	4760	WMIC.exe
Token: SeIncBasePriorityPrivilege	4760	WMIC.exe
Token: SeCreatePagefilePrivilege	4760	WMIC.exe
Token: SeBackupPrivilege	4760	WMIC.exe
Token: SeRestorePrivilege	4760	WMIC.exe
Token: SeShutdownPrivilege	4760	WMIC.exe
Token: SeDebugPrivilege	4760	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4760	WMIC.exe
Token: SeRemoteShutdownPrivilege	4760	WMIC.exe
Token: SeUndockPrivilege	4760	WMIC.exe
Token: SeManageVolumePrivilege	4760	WMIC.exe
Token: 33	4760	WMIC.exe
Token: 34	4760	WMIC.exe
Token: 35	4760	WMIC.exe
Token: 36	4760	WMIC.exe
Token: SeBackupPrivilege	4896	vssvc.exe
Token: SeRestorePrivilege	4896	vssvc.exe
Token: SeAuditPrivilege	4896	vssvc.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.exeabfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.execmd.exe

description	pid	process	target process
PID 2088 wrote to memory of 4024	2088	abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.exe	abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.exe
PID 2088 wrote to memory of 4024	2088	abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.exe	abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.exe
PID 2088 wrote to memory of 4024	2088	abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.exe	abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.exe
PID 2088 wrote to memory of 4024	2088	abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.exe	abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.exe
PID 4024 wrote to memory of 2476	4024	abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.exe	cmd.exe
PID 4024 wrote to memory of 2476	4024	abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.exe	cmd.exe
PID 2476 wrote to memory of 4760	2476	cmd.exe	WMIC.exe
PID 2476 wrote to memory of 4760	2476	cmd.exe	WMIC.exe

C:\Users\Admin\AppData\Local\Temp\abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.exe
"C:\Users\Admin\AppData\Local\Temp\abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2088

C:\Users\Admin\AppData\Local\Temp\abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.exe
"C:\Users\Admin\AppData\Local\Temp\abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4024

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:2476

C:\Windows\system32\wbem\WMIC.exe
C:\Windows\system32\wbem\wmic.exe shadowcopy delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4760

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

1

T1107

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsy421B.tmp\System.dll

Filesize
11KB

MD5
ca332bb753b0775d5e806e236ddcec55

SHA1
f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f

SHA256
df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d

SHA512
2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00

Download Submit
memory/2088-134-0x0000000002170000-0x000000000219C000-memory.dmp

Filesize
176KB

Download
memory/2088-135-0x0000000002170000-0x000000000219C000-memory.dmp

Filesize
176KB

Download
memory/2088-137-0x0000000002170000-0x000000000219C000-memory.dmp

Filesize
176KB

Download
memory/2476-140-0x0000000000000000-mapping.dmp

Download
memory/4024-136-0x0000000000000000-mapping.dmp

Download
memory/4024-138-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4024-139-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4760-141-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads