420dfb75c981fe4ab474de914e92c8171f52544d1f3a4d66bf9249e8578d729d

General

Target

62ee5b95c34acf1b01e338ad370c4dda687bdd67.exe
Size

248KB
MD5

4ca04b351bb18652fcda67b45eed03a9
SHA1

62ee5b95c34acf1b01e338ad370c4dda687bdd67
SHA256

420dfb75c981fe4ab474de914e92c8171f52544d1f3a4d66bf9249e8578d729d
SHA512

d462553e89b0adda35854157bdbb668dc6ac7e415f5dcf37cf65aecd19ff1d93f0aa18e8831f59be5982c21d71715dfa227958696b81d71a9cde8ec9bc79c7b6
SSDEEP

6144:m8OyFY+X5tuRG9YodJ8mQccZowlFfo7qa4D64+94QIKgFLKyEs2UfaoksNzB1jpU:TFY+X5tuRG9YodJ8mQccZowlFfo7qa4U

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1708	tmp2251.tmp.exe

Loads dropped DLL 1 IoCs

pid	Process
1972	62ee5b95c34acf1b01e338ad370c4dda687bdd67.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	tmp2251.tmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	tmp2251.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
976	powershell.exe
976	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1972	62ee5b95c34acf1b01e338ad370c4dda687bdd67.exe
Token: SeDebugPrivilege	976	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1708	1972	62ee5b95c34acf1b01e338ad370c4dda687bdd67.exe	27
PID 1972 wrote to memory of 1708	1972	62ee5b95c34acf1b01e338ad370c4dda687bdd67.exe	27
PID 1972 wrote to memory of 1708	1972	62ee5b95c34acf1b01e338ad370c4dda687bdd67.exe	27
PID 1972 wrote to memory of 1708	1972	62ee5b95c34acf1b01e338ad370c4dda687bdd67.exe	27
PID 1708 wrote to memory of 600	1708	tmp2251.tmp.exe	28
PID 1708 wrote to memory of 600	1708	tmp2251.tmp.exe	28
PID 1708 wrote to memory of 600	1708	tmp2251.tmp.exe	28
PID 1708 wrote to memory of 600	1708	tmp2251.tmp.exe	28
PID 1708 wrote to memory of 336	1708	tmp2251.tmp.exe	30
PID 1708 wrote to memory of 336	1708	tmp2251.tmp.exe	30
PID 1708 wrote to memory of 336	1708	tmp2251.tmp.exe	30
PID 1708 wrote to memory of 336	1708	tmp2251.tmp.exe	30
PID 336 wrote to memory of 1408	336	cmd.exe	32
PID 336 wrote to memory of 1408	336	cmd.exe	32
PID 336 wrote to memory of 1408	336	cmd.exe	32
PID 336 wrote to memory of 1408	336	cmd.exe	32
PID 1408 wrote to memory of 976	1408	cmd.exe	33
PID 1408 wrote to memory of 976	1408	cmd.exe	33
PID 1408 wrote to memory of 976	1408	cmd.exe	33
PID 1408 wrote to memory of 976	1408	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\62ee5b95c34acf1b01e338ad370c4dda687bdd67.exe
"C:\Users\Admin\AppData\Local\Temp\62ee5b95c34acf1b01e338ad370c4dda687bdd67.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Users\Admin\AppData\Local\Temp\tmp2251.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp2251.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ashfdjkhgwiueghfruihwjkefwe
    3⤵
    PID:600
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c cmd < 2
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:336
  - - C:\Windows\SysWOW64\cmd.exe
      cmd
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1408
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell get-process avastui
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2

Filesize
11KB

MD5
cf13b620804b451200c2fc35d0955c1e

SHA1
0b9034ce408d6bdfc2d12a5f957361df1494b564

SHA256
968a4e2af5aa8c0ab95e65c08eb5a5ea03d921c9220def24675a676ff3f9fe76

SHA512
a4c73efd6ff723b9067c95258f02ee0570cf076a1d992456bfdccdd064e1771dde530d0dd046d2dad6185cb08eb4d641484f75b94b04f0dfd384bdd60fd22f26

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2251.tmp.exe

Filesize
1.3MB

MD5
2d48214132e5c4d808740e71ec5f6a7f

SHA1
f3c7534d9f139782006b5656ec0d229d8d9d356e

SHA256
c1fadb8e09ba1257f7656be5a1c8d44e2a0da8697e8e0a32485714949a6c29ca

SHA512
71b38bc31ecd199d3408e831c0cda0b0fbce6b363d5da3500767ff2a9a02fc0b3990512085d8d44e25b50e87eceaf4527e58d9c3e0a0802efbc3164af94a77a2

Download Submit
\Users\Admin\AppData\Local\Temp\tmp2251.tmp.exe

Filesize
1.3MB

MD5
2d48214132e5c4d808740e71ec5f6a7f

SHA1
f3c7534d9f139782006b5656ec0d229d8d9d356e

SHA256
c1fadb8e09ba1257f7656be5a1c8d44e2a0da8697e8e0a32485714949a6c29ca

SHA512
71b38bc31ecd199d3408e831c0cda0b0fbce6b363d5da3500767ff2a9a02fc0b3990512085d8d44e25b50e87eceaf4527e58d9c3e0a0802efbc3164af94a77a2

Download Submit
memory/976-66-0x000000006F600000-0x000000006FBAB000-memory.dmp

Filesize
5.7MB

Download
memory/976-67-0x000000006F600000-0x000000006FBAB000-memory.dmp

Filesize
5.7MB

Download
memory/1972-54-0x0000000000930000-0x000000000096E000-memory.dmp

Filesize
248KB

Download
memory/1972-56-0x0000000004925000-0x0000000004936000-memory.dmp

Filesize
68KB

Download
memory/1972-55-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1972-68-0x0000000004925000-0x0000000004936000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing