fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7

General

Target

fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Size

1.0MB
MD5

18c568e53faffb2a0df0f901cbe34e59
SHA1

eddf7630413cea192af31bb4ded589368262b8ad
SHA256

fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7
SHA512

958a02706cd5880efff0f24f0c7aa1cb65b54660babc8c47718fa8de6e80fdd41a9034626d94111d98a1dead48cfd308d7d92e3fd3edce99e35a4ead6ca5eac9
SSDEEP

24576:c0ab20Kn8RtgUgHIWuvpwCXi45m0SevpEi9k7zoQmZvVQD0nMuQ/sO:pAR6pHImCXi45lSevpEie7zoQmZJnP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4604	~~7647750334061635640.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeBackupPrivilege	1688	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: SeRestorePrivilege	1688	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: 33	1688	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: SeIncBasePriorityPrivilege	1688	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: 33	1688	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: SeIncBasePriorityPrivilege	1688	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: SeBackupPrivilege	1236	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: SeRestorePrivilege	1236	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: 33	1236	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: SeIncBasePriorityPrivilege	1236	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: 33	1688	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: SeIncBasePriorityPrivilege	1688	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: 33	1688	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: SeIncBasePriorityPrivilege	1688	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: SeBackupPrivilege	4568	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: SeRestorePrivilege	4568	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: 33	4568	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
Token: SeIncBasePriorityPrivilege	4568	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1236	1688	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe	83
PID 1688 wrote to memory of 1236	1688	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe	83
PID 1688 wrote to memory of 1236	1688	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe	83
PID 1688 wrote to memory of 4604	1688	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe	84
PID 1688 wrote to memory of 4604	1688	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe	84
PID 1688 wrote to memory of 4604	1688	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe	84
PID 1688 wrote to memory of 4568	1688	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe	89
PID 1688 wrote to memory of 4568	1688	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe	89
PID 1688 wrote to memory of 4568	1688	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe	89
PID 4568 wrote to memory of 4972	4568	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe	90
PID 4568 wrote to memory of 4972	4568	fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe	90

C:\Users\Admin\AppData\Local\Temp\fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
"C:\Users\Admin\AppData\Local\Temp\fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Users\Admin\AppData\Local\Temp\fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
  PECMD**pecmd-cmd* PUTF "C:\Users\Admin\AppData\Local\Temp\~~7647750334061635640.tmp.exe",,"C:\Users\Admin\AppData\Local\Temp\fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe""#102|SCRIPT"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1236
- C:\Users\Admin\AppData\Local\Temp\~~7647750334061635640.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\~~7647750334061635640.tmp.exe"
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Users\Admin\AppData\Local\Temp\fa7f7d4747f344ecfd54082030e0a46bd7ea800f7c0aca08af0c678399c8a6a7.exe
  PECMD**pecmd-cmd* EXEC -wd:C: -hide cmd /c "C:\Users\Admin\AppData\Local\Temp\~3685104694181568164.cmd"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\~3685104694181568164.cmd"
    3⤵
    PID:4972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~3685104694181568164.cmd

Filesize
404B

MD5
a64d3b6d78a71442842eb8df114d990c

SHA1
b976a7ceb955f346e687066bb11b235bf2fc5d99

SHA256
262d0ef9d55761412aabf27528cf25930f591737ee2ebba99ca041f4fe5fb01e

SHA512
ff5626dd053ac9474a7abee467e7d0aefb584326a93cc3077c345e94991254aab9c0618ab92458a469c2df9a10412a8bfb879a1e2b239aaae8eea1f099ecf41d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~3685104694181568164.cmd

Filesize
404B

MD5
a64d3b6d78a71442842eb8df114d990c

SHA1
b976a7ceb955f346e687066bb11b235bf2fc5d99

SHA256
262d0ef9d55761412aabf27528cf25930f591737ee2ebba99ca041f4fe5fb01e

SHA512
ff5626dd053ac9474a7abee467e7d0aefb584326a93cc3077c345e94991254aab9c0618ab92458a469c2df9a10412a8bfb879a1e2b239aaae8eea1f099ecf41d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~~7647750334061635640.tmp.exe

Filesize
158KB

MD5
de4eebb679d0693288cd73a3acc4c933

SHA1
7d0ed48bc5a5a9e9dce7f75a8ce84b86bb5f19d4

SHA256
00c3b02a20ac40fc61c3c83da91c6271ec6accd4881d5cc77ac1a42dc504bf50

SHA512
13aeb9988bdaa719df100c66ba2666c83ac1d9c96d069e8a07aa233e7b72bd2f69bd09d97791dfd5c5bfb5920d108b8ccfa1b28134125f154ea39ec1eff1d08c

Download Submit
C:\Users\Admin\AppData\Local\Temp\~~7647750334061635640.tmp.exe

Filesize
158KB

MD5
de4eebb679d0693288cd73a3acc4c933

SHA1
7d0ed48bc5a5a9e9dce7f75a8ce84b86bb5f19d4

SHA256
00c3b02a20ac40fc61c3c83da91c6271ec6accd4881d5cc77ac1a42dc504bf50

SHA512
13aeb9988bdaa719df100c66ba2666c83ac1d9c96d069e8a07aa233e7b72bd2f69bd09d97791dfd5c5bfb5920d108b8ccfa1b28134125f154ea39ec1eff1d08c

Download Submit

Analysis

Sharing