fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7

General

Target

fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Size

1.0MB
MD5

18c568e53faffb2a0df0f901cbe34e59
SHA1

eddf7630413cea192af31bb4ded589368262b8ad
SHA256

fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7
SHA512

958a02706cd5880efff0f24f0c7aa1cb65b54660babc8c47718fa8de6e80fdd41a9034626d94111d98a1dead48cfd308d7d92e3fd3edce99e35a4ead6ca5eac9
SSDEEP

24576:c0ab20Kn8RtgUgHIWuvpwCXi45m0SevpEi9k7zoQmZvVQD0nMuQ/sO:pAR6pHImCXi45lSevpEie7zoQmZJnP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2796	~~4660940488294451455.tmp.exe

Loads dropped DLL 1 IoCs

pid	Process
2788	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeBackupPrivilege	2788	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: SeRestorePrivilege	2788	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: 33	2788	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: SeIncBasePriorityPrivilege	2788	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: 33	2788	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: SeIncBasePriorityPrivilege	2788	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: SeBackupPrivilege	3032	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: SeRestorePrivilege	3032	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: 33	3032	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: SeIncBasePriorityPrivilege	3032	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: 33	2788	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: SeIncBasePriorityPrivilege	2788	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: 33	2788	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: SeIncBasePriorityPrivilege	2788	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: SeBackupPrivilege	2908	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: SeRestorePrivilege	2908	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: 33	2908	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: SeIncBasePriorityPrivilege	2908	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 3032	2788	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe	28
PID 2788 wrote to memory of 3032	2788	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe	28
PID 2788 wrote to memory of 3032	2788	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe	28
PID 2788 wrote to memory of 3032	2788	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe	28
PID 2788 wrote to memory of 2796	2788	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe	29
PID 2788 wrote to memory of 2796	2788	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe	29
PID 2788 wrote to memory of 2796	2788	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe	29
PID 2788 wrote to memory of 2796	2788	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe	29
PID 2788 wrote to memory of 2908	2788	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe	30
PID 2788 wrote to memory of 2908	2788	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe	30
PID 2788 wrote to memory of 2908	2788	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe	30
PID 2788 wrote to memory of 2908	2788	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe	30
PID 2908 wrote to memory of 2876	2908	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe	31
PID 2908 wrote to memory of 2876	2908	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe	31
PID 2908 wrote to memory of 2876	2908	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe	31
PID 2908 wrote to memory of 2876	2908	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe	31

C:\Users\Admin\AppData\Local\Temp\fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
"C:\Users\Admin\AppData\Local\Temp\fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Users\Admin\AppData\Local\Temp\fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
  PECMD**pecmd-cmd* PUTF "C:\Users\Admin\AppData\Local\Temp\~~4660940488294451455.tmp.exe",,"C:\Users\Admin\AppData\Local\Temp\fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe""#102|SCRIPT"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3032
- C:\Users\Admin\AppData\Local\Temp\~~4660940488294451455.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\~~4660940488294451455.tmp.exe"
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Users\Admin\AppData\Local\Temp\fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
  PECMD**pecmd-cmd* EXEC -wd:C: -hide cmd /c "C:\Users\Admin\AppData\Local\Temp\~7424568570109982869.cmd"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\~7424568570109982869.cmd"
    3⤵
    PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~7424568570109982869.cmd

Filesize
404B

MD5
a38b75a814c105a9d19acac56b481bf8

SHA1
27cc0d8b4275d83cbe1f4de528f0f418d6dff828

SHA256
f63282776ccb4d1306712ff1fec47dfbd55b6ce94a3a4e2dfe51f53f653de496

SHA512
6bc4cf7db8aa274a1afa77917936b7cc983ca619447ebd495a749be6dcee8254d623cbe2ca637b484d190d54069c2cea71c78d29147f142d5b0d5e1d5f8d5f5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\~7424568570109982869.cmd

Filesize
404B

MD5
a38b75a814c105a9d19acac56b481bf8

SHA1
27cc0d8b4275d83cbe1f4de528f0f418d6dff828

SHA256
f63282776ccb4d1306712ff1fec47dfbd55b6ce94a3a4e2dfe51f53f653de496

SHA512
6bc4cf7db8aa274a1afa77917936b7cc983ca619447ebd495a749be6dcee8254d623cbe2ca637b484d190d54069c2cea71c78d29147f142d5b0d5e1d5f8d5f5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\~~4660940488294451455.tmp.exe

Filesize
158KB

MD5
de4eebb679d0693288cd73a3acc4c933

SHA1
7d0ed48bc5a5a9e9dce7f75a8ce84b86bb5f19d4

SHA256
00c3b02a20ac40fc61c3c83da91c6271ec6accd4881d5cc77ac1a42dc504bf50

SHA512
13aeb9988bdaa719df100c66ba2666c83ac1d9c96d069e8a07aa233e7b72bd2f69bd09d97791dfd5c5bfb5920d108b8ccfa1b28134125f154ea39ec1eff1d08c

Download Submit
C:\Users\Admin\AppData\Local\Temp\~~4660940488294451455.tmp.exe

Filesize
158KB

MD5
de4eebb679d0693288cd73a3acc4c933

SHA1
7d0ed48bc5a5a9e9dce7f75a8ce84b86bb5f19d4

SHA256
00c3b02a20ac40fc61c3c83da91c6271ec6accd4881d5cc77ac1a42dc504bf50

SHA512
13aeb9988bdaa719df100c66ba2666c83ac1d9c96d069e8a07aa233e7b72bd2f69bd09d97791dfd5c5bfb5920d108b8ccfa1b28134125f154ea39ec1eff1d08c

Download Submit
\Users\Admin\AppData\Local\Temp\~~4660940488294451455.tmp.exe

Filesize
158KB

MD5
de4eebb679d0693288cd73a3acc4c933

SHA1
7d0ed48bc5a5a9e9dce7f75a8ce84b86bb5f19d4

SHA256
00c3b02a20ac40fc61c3c83da91c6271ec6accd4881d5cc77ac1a42dc504bf50

SHA512
13aeb9988bdaa719df100c66ba2666c83ac1d9c96d069e8a07aa233e7b72bd2f69bd09d97791dfd5c5bfb5920d108b8ccfa1b28134125f154ea39ec1eff1d08c

Download Submit

Analysis

Sharing