27b4976e8160e96a6920fa006759c012569295ecedf97644c5c40dd6b79ac071

General

Target

27b4976e8160e96a6920fa006759c012569295ecedf97644c5c40dd6b79ac071.exe
Size

249KB
MD5

08b06a4ec8fcfa31d8fb266a59b6d5fe
SHA1

b1f990fb77f9106be0c562875e1cfdc230ddde93
SHA256

27b4976e8160e96a6920fa006759c012569295ecedf97644c5c40dd6b79ac071
SHA512

f7f9b8e3e9fb2669c52de93acd0150d9c5fe5749456a6936ad2b4e2b4542ce9eebbe6f0b644816b828e0f99b2fb5637a6eed6d1815e938094f8d2f45eea39eff
SSDEEP

6144:we346C2FMt5q2pd5A8WE388IxRMKGsbb9Eqk5d388IxRMrm:NC2+bJd5A878H/Csbh4x8H/p

Score

8^/10

evasion

Malware Config

Signatures

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Loads dropped DLL 6 IoCs

pid	Process
1928	27b4976e8160e96a6920fa006759c012569295ecedf97644c5c40dd6b79ac071.exe
1928	27b4976e8160e96a6920fa006759c012569295ecedf97644c5c40dd6b79ac071.exe
1928	27b4976e8160e96a6920fa006759c012569295ecedf97644c5c40dd6b79ac071.exe
1928	27b4976e8160e96a6920fa006759c012569295ecedf97644c5c40dd6b79ac071.exe
1928	27b4976e8160e96a6920fa006759c012569295ecedf97644c5c40dd6b79ac071.exe
1928	27b4976e8160e96a6920fa006759c012569295ecedf97644c5c40dd6b79ac071.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
576	sc.exe
1796	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
2008	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2008	taskkill.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 576	1928	27b4976e8160e96a6920fa006759c012569295ecedf97644c5c40dd6b79ac071.exe	26
PID 1928 wrote to memory of 576	1928	27b4976e8160e96a6920fa006759c012569295ecedf97644c5c40dd6b79ac071.exe	26
PID 1928 wrote to memory of 576	1928	27b4976e8160e96a6920fa006759c012569295ecedf97644c5c40dd6b79ac071.exe	26
PID 1928 wrote to memory of 576	1928	27b4976e8160e96a6920fa006759c012569295ecedf97644c5c40dd6b79ac071.exe	26
PID 1928 wrote to memory of 1796	1928	27b4976e8160e96a6920fa006759c012569295ecedf97644c5c40dd6b79ac071.exe	28
PID 1928 wrote to memory of 1796	1928	27b4976e8160e96a6920fa006759c012569295ecedf97644c5c40dd6b79ac071.exe	28
PID 1928 wrote to memory of 1796	1928	27b4976e8160e96a6920fa006759c012569295ecedf97644c5c40dd6b79ac071.exe	28
PID 1928 wrote to memory of 1796	1928	27b4976e8160e96a6920fa006759c012569295ecedf97644c5c40dd6b79ac071.exe	28
PID 1928 wrote to memory of 2008	1928	27b4976e8160e96a6920fa006759c012569295ecedf97644c5c40dd6b79ac071.exe	30
PID 1928 wrote to memory of 2008	1928	27b4976e8160e96a6920fa006759c012569295ecedf97644c5c40dd6b79ac071.exe	30
PID 1928 wrote to memory of 2008	1928	27b4976e8160e96a6920fa006759c012569295ecedf97644c5c40dd6b79ac071.exe	30
PID 1928 wrote to memory of 2008	1928	27b4976e8160e96a6920fa006759c012569295ecedf97644c5c40dd6b79ac071.exe	30
PID 1928 wrote to memory of 456	1928	27b4976e8160e96a6920fa006759c012569295ecedf97644c5c40dd6b79ac071.exe	33
PID 1928 wrote to memory of 456	1928	27b4976e8160e96a6920fa006759c012569295ecedf97644c5c40dd6b79ac071.exe	33
PID 1928 wrote to memory of 456	1928	27b4976e8160e96a6920fa006759c012569295ecedf97644c5c40dd6b79ac071.exe	33
PID 1928 wrote to memory of 456	1928	27b4976e8160e96a6920fa006759c012569295ecedf97644c5c40dd6b79ac071.exe	33

C:\Users\Admin\AppData\Local\Temp\27b4976e8160e96a6920fa006759c012569295ecedf97644c5c40dd6b79ac071.exe
"C:\Users\Admin\AppData\Local\Temp\27b4976e8160e96a6920fa006759c012569295ecedf97644c5c40dd6b79ac071.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\sc.exe
  sc stop SrvUpdater
  2⤵
  - Launches sc.exe
  PID:576
- C:\Windows\SysWOW64\sc.exe
  sc delete SrvUpdater
  2⤵
  - Launches sc.exe
  PID:1796
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im AppsUpd4ter.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2008
- C:\Windows\SysWOW64\SCHTASKS.exe
  SCHTASKS /Delete /tn "Google Update" /F
  2⤵
  PID:456

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nst6634.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nst6634.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst6634.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst6634.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst6634.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst6634.tmp\nsURL.dll

Filesize
111KB

MD5
47ce43c4d3668e2082067451522e2ea1

SHA1
57cb49fdffe6e7c44debea97a09c9676319802bc

SHA256
b6874cb9745ed458a7568e668a10d62a5c098c706cf0b69e1f7f033b20c0b5e6

SHA512
7513754ce261306ebb3f1960a9964eb2f896f2f18e7b184df73fbde31849d282b35b9bff8fed38cc0a3b87eeaa39f93c3215dc9b0db238af7ec76215726e4636

Download Submit
memory/456-63-0x0000000000000000-mapping.dmp

Download
memory/576-57-0x0000000000000000-mapping.dmp

Download
memory/1796-59-0x0000000000000000-mapping.dmp

Download
memory/1928-54-0x00000000762B1000-0x00000000762B3000-memory.dmp

Filesize
8KB

Download
memory/2008-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing