e45833cc1b31266b7b8772389417ef4bdfbc423242c713cb59185eb869e30947

General

Target

e45833cc1b31266b7b8772389417ef4bdfbc423242c713cb59185eb869e30947.exe
Size

134KB
MD5

e14d8800c4bf7823a7da6cf931a06869
SHA1

b3921f7bf4bfffcb13a7ec7a27e0ea511b3dd9c9
SHA256

e45833cc1b31266b7b8772389417ef4bdfbc423242c713cb59185eb869e30947
SHA512

b6b2b32c221e0bc1ef6744c41a93241079bdd360371dbd65e25acf112b1de035fb7bfda0e47753d4a9f75c4a76a8f48d1a0b04383322ac27e78a13f2557d71ee
SSDEEP

3072:lq6+ouCpk2mpcWJ0r+QNTBfQkXSJmQZYs:lldk1cWQRNTBIoXm/

Score

8^/10

discovery exploit

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

attrib.exe

description ioc process

File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe
Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

1756 takeown.exe
688 icacls.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exetakeown.exe

pid process

688 icacls.exe
1756 takeown.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Download via BitsAdmin 1 TTPs 1 IoCs
dropper

BITS Jobs
T1197

Processes:

bitsadmin.exe

pid process

772 bitsadmin.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

pid	process
1756	takeown.exe
688	icacls.exe

pid	process
688	icacls.exe
1756	takeown.exe

pid	process
772	bitsadmin.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

e45833cc1b31266b7b8772389417ef4bdfbc423242c713cb59185eb869e30947.execmd.execmd.exe

description	pid	process	target process
PID 1600 wrote to memory of 1168	1600	e45833cc1b31266b7b8772389417ef4bdfbc423242c713cb59185eb869e30947.exe	cmd.exe
PID 1600 wrote to memory of 1168	1600	e45833cc1b31266b7b8772389417ef4bdfbc423242c713cb59185eb869e30947.exe	cmd.exe
PID 1600 wrote to memory of 1168	1600	e45833cc1b31266b7b8772389417ef4bdfbc423242c713cb59185eb869e30947.exe	cmd.exe
PID 1600 wrote to memory of 1168	1600	e45833cc1b31266b7b8772389417ef4bdfbc423242c713cb59185eb869e30947.exe	cmd.exe
PID 1168 wrote to memory of 1792	1168	cmd.exe	cmd.exe
PID 1168 wrote to memory of 1792	1168	cmd.exe	cmd.exe
PID 1168 wrote to memory of 1792	1168	cmd.exe	cmd.exe
PID 1792 wrote to memory of 1756	1792	cmd.exe	takeown.exe
PID 1792 wrote to memory of 1756	1792	cmd.exe	takeown.exe
PID 1792 wrote to memory of 1756	1792	cmd.exe	takeown.exe
PID 1168 wrote to memory of 688	1168	cmd.exe	icacls.exe
PID 1168 wrote to memory of 688	1168	cmd.exe	icacls.exe
PID 1168 wrote to memory of 688	1168	cmd.exe	icacls.exe
PID 1168 wrote to memory of 468	1168	cmd.exe	attrib.exe
PID 1168 wrote to memory of 468	1168	cmd.exe	attrib.exe
PID 1168 wrote to memory of 468	1168	cmd.exe	attrib.exe
PID 1168 wrote to memory of 772	1168	cmd.exe	bitsadmin.exe
PID 1168 wrote to memory of 772	1168	cmd.exe	bitsadmin.exe
PID 1168 wrote to memory of 772	1168	cmd.exe	bitsadmin.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

468 attrib.exe

pid	process
468	attrib.exe

C:\Users\Admin\AppData\Local\Temp\e45833cc1b31266b7b8772389417ef4bdfbc423242c713cb59185eb869e30947.exe
"C:\Users\Admin\AppData\Local\Temp\e45833cc1b31266b7b8772389417ef4bdfbc423242c713cb59185eb869e30947.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1600

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1288.tmp\1289.tmp\128A.bat C:\Users\Admin\AppData\Local\Temp\e45833cc1b31266b7b8772389417ef4bdfbc423242c713cb59185eb869e30947.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1168

C:\Windows\system32\cmd.exe
cmd.exe /c takeown /f "C:\Windows\System32\drivers\etc\hosts"
3⤵
- Suspicious use of WriteProcessMemory
PID:1792

C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\System32\drivers\etc\hosts"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1756

C:\Windows\system32\icacls.exe
icacls "C:\Windows\System32\drivers\etc\hosts" /grant ?░?????????????é???░?é?????ï:F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:688

C:\Windows\system32\attrib.exe
attrib -R -S -H "C:\Windows\System32\drivers\etc\hosts"
3⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:468

C:\Windows\system32\bitsadmin.exe
bitsadmin /transfer /download https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocker/master/data/hosts/extra.txt C:\Users\Admin\AppData\Local\Temp\hosts
3⤵
- Download via BitsAdmin
PID:772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

BITS Jobs

1

T1197

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

BITS Jobs

1

T1197

File and Directory Permissions Modification

1

T1222

Hidden Files and Directories

Web Service

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1288.tmp\1289.tmp\128A.bat

Filesize
519B

MD5
4b86a75880544184dc922bd8ecb8fa0b

SHA1
8e1a1afa00ba5d0149ea61e72d476a124f01284b

SHA256
36cedadb6e12bd9e07d4e7f06cc5c0218b4cdcd9b4041c8b74b25e49f9c9420a

SHA512
0d12eefbc8c9ba57a46b91f7e1c90f9b07ef16e69466d55c11a1e5a5968b8d302544e449fb048b2b9c0760d3be96be434aca551f3f17adf50b18cd69014a1691

Download Submit
memory/468-60-0x0000000000000000-mapping.dmp

Download
memory/688-59-0x0000000000000000-mapping.dmp

Download
memory/772-61-0x0000000000000000-mapping.dmp

Download
memory/1168-55-0x0000000000000000-mapping.dmp

Download
memory/1600-54-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download
memory/1756-58-0x0000000000000000-mapping.dmp

Download
memory/1792-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing