746a98abba2b730426daf3de9455226170328090abc9e566c92efa78bededd30

General

Target

746a98abba2b730426daf3de9455226170328090abc9e566c92efa78bededd30.exe
Size

38KB
MD5

14fbe83abebe30e4d841f5dd02d66e50
SHA1

cd55c358b507da78b7a70afb0cc6a71ad25e0885
SHA256

746a98abba2b730426daf3de9455226170328090abc9e566c92efa78bededd30
SHA512

14223f97b61e153145ebc1c508102c74199b7831257e644c58dc5e3fc7f797c02c984117022abc1b9aba9cb23d7ad88804d0a2bc728e2b6b4153528679f04b66
SSDEEP

768:r+GE+o7aZvxGAEJBrIvtjH89lsCtG9x0ZypsO/Uker0fr9+INlDBgV:rFE+NJGAEJB01jcrKsO/U/r0fr9fnGV

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1064	Trojan.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
564	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cd9e051ed80df1a0c0b000059793bab8.exe	Trojan.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cd9e051ed80df1a0c0b000059793bab8.exe	Trojan.exe

Loads dropped DLL 2 IoCs

pid	Process
1676	746a98abba2b730426daf3de9455226170328090abc9e566c92efa78bededd30.exe
1676	746a98abba2b730426daf3de9455226170328090abc9e566c92efa78bededd30.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\cd9e051ed80df1a0c0b000059793bab8 = "\"C:\\ProgramData\\Trojan.exe\" .."	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cd9e051ed80df1a0c0b000059793bab8 = "\"C:\\ProgramData\\Trojan.exe\" .."	Trojan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1064	Trojan.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1064	Trojan.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1064	1676	746a98abba2b730426daf3de9455226170328090abc9e566c92efa78bededd30.exe	28
PID 1676 wrote to memory of 1064	1676	746a98abba2b730426daf3de9455226170328090abc9e566c92efa78bededd30.exe	28
PID 1676 wrote to memory of 1064	1676	746a98abba2b730426daf3de9455226170328090abc9e566c92efa78bededd30.exe	28
PID 1676 wrote to memory of 1064	1676	746a98abba2b730426daf3de9455226170328090abc9e566c92efa78bededd30.exe	28
PID 1064 wrote to memory of 564	1064	Trojan.exe	29
PID 1064 wrote to memory of 564	1064	Trojan.exe	29
PID 1064 wrote to memory of 564	1064	Trojan.exe	29
PID 1064 wrote to memory of 564	1064	Trojan.exe	29

C:\Users\Admin\AppData\Local\Temp\746a98abba2b730426daf3de9455226170328090abc9e566c92efa78bededd30.exe
"C:\Users\Admin\AppData\Local\Temp\746a98abba2b730426daf3de9455226170328090abc9e566c92efa78bededd30.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1676
- C:\ProgramData\Trojan.exe
  "C:\ProgramData\Trojan.exe"
  2⤵
  - Executes dropped EXE
  - Drops startup file
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\ProgramData\Trojan.exe" "Trojan.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Trojan.exe

Filesize
38KB

MD5
14fbe83abebe30e4d841f5dd02d66e50

SHA1
cd55c358b507da78b7a70afb0cc6a71ad25e0885

SHA256
746a98abba2b730426daf3de9455226170328090abc9e566c92efa78bededd30

SHA512
14223f97b61e153145ebc1c508102c74199b7831257e644c58dc5e3fc7f797c02c984117022abc1b9aba9cb23d7ad88804d0a2bc728e2b6b4153528679f04b66

Download Submit
C:\ProgramData\Trojan.exe

Filesize
38KB

MD5
14fbe83abebe30e4d841f5dd02d66e50

SHA1
cd55c358b507da78b7a70afb0cc6a71ad25e0885

SHA256
746a98abba2b730426daf3de9455226170328090abc9e566c92efa78bededd30

SHA512
14223f97b61e153145ebc1c508102c74199b7831257e644c58dc5e3fc7f797c02c984117022abc1b9aba9cb23d7ad88804d0a2bc728e2b6b4153528679f04b66

Download Submit
\ProgramData\Trojan.exe

Filesize
38KB

MD5
14fbe83abebe30e4d841f5dd02d66e50

SHA1
cd55c358b507da78b7a70afb0cc6a71ad25e0885

SHA256
746a98abba2b730426daf3de9455226170328090abc9e566c92efa78bededd30

SHA512
14223f97b61e153145ebc1c508102c74199b7831257e644c58dc5e3fc7f797c02c984117022abc1b9aba9cb23d7ad88804d0a2bc728e2b6b4153528679f04b66

Download Submit
\ProgramData\Trojan.exe

Filesize
38KB

MD5
14fbe83abebe30e4d841f5dd02d66e50

SHA1
cd55c358b507da78b7a70afb0cc6a71ad25e0885

SHA256
746a98abba2b730426daf3de9455226170328090abc9e566c92efa78bededd30

SHA512
14223f97b61e153145ebc1c508102c74199b7831257e644c58dc5e3fc7f797c02c984117022abc1b9aba9cb23d7ad88804d0a2bc728e2b6b4153528679f04b66

Download Submit
memory/1064-65-0x00000000742E0000-0x000000007488B000-memory.dmp

Filesize
5.7MB

Download
memory/1064-66-0x00000000742E0000-0x000000007488B000-memory.dmp

Filesize
5.7MB

Download
memory/1676-54-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/1676-55-0x00000000742E0000-0x000000007488B000-memory.dmp

Filesize
5.7MB

Download
memory/1676-62-0x00000000742E0000-0x000000007488B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing