6d60656f1c75ed1c8a4390e43cc077cfbcb8988b01671d03dd35b6efc1adeb16

General

Target

35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe
Size

954KB
MD5

84d034b010bac73cd55bfb6a7f14dede
SHA1

1cc2efd766b673566961e397ec1088f988c7f762
SHA256

35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977
SHA512

1464374f02278801b9277f63c0d73f65f75824911d1da262b57f5fa9bc453705f5603a36b71cc627bbe2fcd55529437200ae93ad249780d4f647aeae1bb55cd6
SSDEEP

24576:j2N8jiZ4zypIPslJTDETLeWIAmZoMhHcRosX32J/PW/ZmvsSX:j2N8jiZ4zypIPoJTDEWqsoM5cXmtiZ0X

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe
924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe
924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe
924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe
924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe
924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe
924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe
924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe
636	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe
Token: SeDebugPrivilege	636	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 636	924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe	28
PID 924 wrote to memory of 636	924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe	28
PID 924 wrote to memory of 636	924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe	28
PID 924 wrote to memory of 636	924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe	28
PID 924 wrote to memory of 692	924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe	30
PID 924 wrote to memory of 692	924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe	30
PID 924 wrote to memory of 692	924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe	30
PID 924 wrote to memory of 692	924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe	30
PID 924 wrote to memory of 1104	924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe	31
PID 924 wrote to memory of 1104	924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe	31
PID 924 wrote to memory of 1104	924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe	31
PID 924 wrote to memory of 1104	924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe	31
PID 924 wrote to memory of 1500	924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe	32
PID 924 wrote to memory of 1500	924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe	32
PID 924 wrote to memory of 1500	924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe	32
PID 924 wrote to memory of 1500	924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe	32
PID 924 wrote to memory of 472	924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe	33
PID 924 wrote to memory of 472	924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe	33
PID 924 wrote to memory of 472	924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe	33
PID 924 wrote to memory of 472	924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe	33
PID 924 wrote to memory of 524	924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe	34
PID 924 wrote to memory of 524	924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe	34
PID 924 wrote to memory of 524	924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe	34
PID 924 wrote to memory of 524	924	35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe	34

C:\Users\Admin\AppData\Local\Temp\35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe
"C:\Users\Admin\AppData\Local\Temp\35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:924
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:636
- C:\Users\Admin\AppData\Local\Temp\35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe
  "C:\Users\Admin\AppData\Local\Temp\35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe"
  2⤵
  PID:692
- C:\Users\Admin\AppData\Local\Temp\35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe
  "C:\Users\Admin\AppData\Local\Temp\35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe"
  2⤵
  PID:1104
- C:\Users\Admin\AppData\Local\Temp\35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe
  "C:\Users\Admin\AppData\Local\Temp\35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe"
  2⤵
  PID:1500
- C:\Users\Admin\AppData\Local\Temp\35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe
  "C:\Users\Admin\AppData\Local\Temp\35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe"
  2⤵
  PID:472
- C:\Users\Admin\AppData\Local\Temp\35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe
  "C:\Users\Admin\AppData\Local\Temp\35bac7b8798c166302e93664c027dc312d0f956e4b9091c8b6c43ea7afbf4977.exe"
  2⤵
  PID:524

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/636-63-0x0000000002830000-0x0000000002870000-memory.dmp

Filesize
256KB

Download
memory/636-64-0x0000000002830000-0x0000000002870000-memory.dmp

Filesize
256KB

Download
memory/636-65-0x0000000002830000-0x0000000002870000-memory.dmp

Filesize
256KB

Download
memory/924-54-0x0000000000340000-0x0000000000434000-memory.dmp

Filesize
976KB

Download
memory/924-55-0x0000000000580000-0x00000000005C0000-memory.dmp

Filesize
256KB

Download
memory/924-56-0x0000000000330000-0x000000000033E000-memory.dmp

Filesize
56KB

Download
memory/924-57-0x0000000000580000-0x00000000005C0000-memory.dmp

Filesize
256KB

Download
memory/924-58-0x00000000004E0000-0x00000000004EA000-memory.dmp

Filesize
40KB

Download
memory/924-59-0x0000000005900000-0x00000000059B4000-memory.dmp

Filesize
720KB

Download
memory/924-60-0x0000000005A10000-0x0000000005A90000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing