e23c61fa4ef7e35270d2682f6da5fa067a3610507a3d631d67fcf060302a54dc

General

Target

046753b5aa6691c61045ec71b8094677.exe
Size

739KB
MD5

046753b5aa6691c61045ec71b8094677
SHA1

8551d892ce75e35a1ebc2813da545857d2b523f9
SHA256

e23c61fa4ef7e35270d2682f6da5fa067a3610507a3d631d67fcf060302a54dc
SHA512

c9051920c6c7469b341ba30c23104ad6ac0009e31e30744922b4b6a7af5e634a525285b0cd8a828648beb2cf88eb8462feb06ec5eb4513fa78e0a223f45cb2b9
SSDEEP

12288:RQDc7YUSW3QDzJ80MRtOE/d9yfZ1+YAJ:g+QXJ80MRtOE/jq2Ym

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1972 set thread context of 112	1972	046753b5aa6691c61045ec71b8094677.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1356	powershell.exe
1972	046753b5aa6691c61045ec71b8094677.exe
1972	046753b5aa6691c61045ec71b8094677.exe
112	InstallUtil.exe
112	InstallUtil.exe
112	InstallUtil.exe
112	InstallUtil.exe
112	InstallUtil.exe
112	InstallUtil.exe
112	InstallUtil.exe
112	InstallUtil.exe
112	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1972	046753b5aa6691c61045ec71b8094677.exe
Token: SeDebugPrivilege	1356	powershell.exe
Token: SeDebugPrivilege	112	InstallUtil.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1356	1972	046753b5aa6691c61045ec71b8094677.exe	28
PID 1972 wrote to memory of 1356	1972	046753b5aa6691c61045ec71b8094677.exe	28
PID 1972 wrote to memory of 1356	1972	046753b5aa6691c61045ec71b8094677.exe	28
PID 1972 wrote to memory of 1356	1972	046753b5aa6691c61045ec71b8094677.exe	28
PID 1972 wrote to memory of 1236	1972	046753b5aa6691c61045ec71b8094677.exe	30
PID 1972 wrote to memory of 1236	1972	046753b5aa6691c61045ec71b8094677.exe	30
PID 1972 wrote to memory of 1236	1972	046753b5aa6691c61045ec71b8094677.exe	30
PID 1972 wrote to memory of 1236	1972	046753b5aa6691c61045ec71b8094677.exe	30
PID 1972 wrote to memory of 1236	1972	046753b5aa6691c61045ec71b8094677.exe	30
PID 1972 wrote to memory of 1236	1972	046753b5aa6691c61045ec71b8094677.exe	30
PID 1972 wrote to memory of 1236	1972	046753b5aa6691c61045ec71b8094677.exe	30
PID 1972 wrote to memory of 112	1972	046753b5aa6691c61045ec71b8094677.exe	31
PID 1972 wrote to memory of 112	1972	046753b5aa6691c61045ec71b8094677.exe	31
PID 1972 wrote to memory of 112	1972	046753b5aa6691c61045ec71b8094677.exe	31
PID 1972 wrote to memory of 112	1972	046753b5aa6691c61045ec71b8094677.exe	31
PID 1972 wrote to memory of 112	1972	046753b5aa6691c61045ec71b8094677.exe	31
PID 1972 wrote to memory of 112	1972	046753b5aa6691c61045ec71b8094677.exe	31
PID 1972 wrote to memory of 112	1972	046753b5aa6691c61045ec71b8094677.exe	31
PID 1972 wrote to memory of 112	1972	046753b5aa6691c61045ec71b8094677.exe	31
PID 1972 wrote to memory of 112	1972	046753b5aa6691c61045ec71b8094677.exe	31
PID 1972 wrote to memory of 112	1972	046753b5aa6691c61045ec71b8094677.exe	31
PID 1972 wrote to memory of 112	1972	046753b5aa6691c61045ec71b8094677.exe	31
PID 1972 wrote to memory of 112	1972	046753b5aa6691c61045ec71b8094677.exe	31

C:\Users\Admin\AppData\Local\Temp\046753b5aa6691c61045ec71b8094677.exe
"C:\Users\Admin\AppData\Local\Temp\046753b5aa6691c61045ec71b8094677.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC bQBvAHYAZQAgACIARABlAG0AbwBuAF8AcwAgAE0AYQBpAGQALgBlAHgAZQAiACAATQBvAG4AbwBCAGwAZQBlAGQAaQBuAGcARQBkAGcAZQBcAGUAdABjAFwAbQBvAG4AbwBcADQALgAwAFwAQgByAG8AdwBzAGUAcgBzAFwAQwBvAG0AcABhAHQAMgAuAGIAcgBvAHcAcwBlAHIAOwBtAG8AdgBlACAATQBvAG4AbwBCAGwAZQBlAGQAaQBuAGcARQBkAGcAZQBcAGUAdABjAFwAbQBvAG4AbwBcADQALgAwAFwAQgByAG8AdwBzAGUAcgBzAFwAIgBEAGUAbQBvAG4AXwBzACAATQBhAGkAZAAuAGUAeABlACIAOwBzAHQAYQByAHQAIAAiAEQAZQBtAG8AbgBfAHMAIABNAGEAaQBkAC4AZQB4AGUAIgA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1356
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  2⤵
  PID:1236
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

1

T1102

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/112-72-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/112-67-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/112-74-0x0000000004380000-0x00000000043C0000-memory.dmp

Filesize
256KB

Download
memory/112-73-0x0000000004380000-0x00000000043C0000-memory.dmp

Filesize
256KB

Download
memory/112-70-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/112-68-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/112-63-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/112-66-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/112-65-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/112-64-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1356-61-0x0000000002450000-0x0000000002490000-memory.dmp

Filesize
256KB

Download
memory/1356-62-0x0000000002450000-0x0000000002490000-memory.dmp

Filesize
256KB

Download
memory/1972-55-0x0000000004880000-0x00000000048C0000-memory.dmp

Filesize
256KB

Download
memory/1972-54-0x0000000000230000-0x00000000002EE000-memory.dmp

Filesize
760KB

Download
memory/1972-57-0x0000000005910000-0x00000000059A2000-memory.dmp

Filesize
584KB

Download
memory/1972-56-0x0000000006510000-0x000000000669C000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing