e5e6dda576bbe9d03c05cef4f9858a772dd7fb183d62720ad694397ec33176eb

General

Target

50a456af5652c967f961a64cf3575cea.exe
Size

212KB
MD5

50a456af5652c967f961a64cf3575cea
SHA1

4d04414c7a3aa8ed11914983b9db386a784cb286
SHA256

e5e6dda576bbe9d03c05cef4f9858a772dd7fb183d62720ad694397ec33176eb
SHA512

217b2642f9d5d8a5af818c9d1e5805ba439c8ddeef467152ed99c5d62548fe5f229713842d3c72ea417c4f9cc58baac9368995ac0f2c6bec49280c8012904504
SSDEEP

3072:13TzXu32JVDHa94mHkIu8aauuuoQOzaKZEUHCRix3qO43F/oNO:13PXu3WITV9aaE0aKZhrxm/oNO

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2512	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2660	qhjwfvjd.exe

Loads dropped DLL 4 IoCs

pid	Process
2512	cmd.exe
2512	cmd.exe
2660	qhjwfvjd.exe
2660	qhjwfvjd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
2732	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2740	PING.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2660	qhjwfvjd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2732	taskkill.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2660	qhjwfvjd.exe
2660	qhjwfvjd.exe
2660	qhjwfvjd.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2660	qhjwfvjd.exe
2660	qhjwfvjd.exe
2660	qhjwfvjd.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 2512	852	50a456af5652c967f961a64cf3575cea.exe	28
PID 852 wrote to memory of 2512	852	50a456af5652c967f961a64cf3575cea.exe	28
PID 852 wrote to memory of 2512	852	50a456af5652c967f961a64cf3575cea.exe	28
PID 852 wrote to memory of 2512	852	50a456af5652c967f961a64cf3575cea.exe	28
PID 2512 wrote to memory of 2732	2512	cmd.exe	30
PID 2512 wrote to memory of 2732	2512	cmd.exe	30
PID 2512 wrote to memory of 2732	2512	cmd.exe	30
PID 2512 wrote to memory of 2732	2512	cmd.exe	30
PID 2512 wrote to memory of 2740	2512	cmd.exe	32
PID 2512 wrote to memory of 2740	2512	cmd.exe	32
PID 2512 wrote to memory of 2740	2512	cmd.exe	32
PID 2512 wrote to memory of 2740	2512	cmd.exe	32
PID 2512 wrote to memory of 2660	2512	cmd.exe	33
PID 2512 wrote to memory of 2660	2512	cmd.exe	33
PID 2512 wrote to memory of 2660	2512	cmd.exe	33
PID 2512 wrote to memory of 2660	2512	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\50a456af5652c967f961a64cf3575cea.exe
"C:\Users\Admin\AppData\Local\Temp\50a456af5652c967f961a64cf3575cea.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /f /pid 852 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\50a456af5652c967f961a64cf3575cea.exe" & start C:\Users\Admin\AppData\Local\qhjwfvjd.exe -f
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /pid 852
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2732
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.1
    3⤵
    - Runs ping.exe
    PID:2740
- - C:\Users\Admin\AppData\Local\qhjwfvjd.exe
    C:\Users\Admin\AppData\Local\qhjwfvjd.exe -f
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\qhjwfvjd.exe

Filesize
212KB

MD5
50a456af5652c967f961a64cf3575cea

SHA1
4d04414c7a3aa8ed11914983b9db386a784cb286

SHA256
e5e6dda576bbe9d03c05cef4f9858a772dd7fb183d62720ad694397ec33176eb

SHA512
217b2642f9d5d8a5af818c9d1e5805ba439c8ddeef467152ed99c5d62548fe5f229713842d3c72ea417c4f9cc58baac9368995ac0f2c6bec49280c8012904504

Download Submit
memory/852-0-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/852-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/852-2-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/852-4-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/852-5-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/852-6-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/852-7-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/2660-17-0x00000000002E0000-0x00000000002E2000-memory.dmp

Filesize
8KB

Download
memory/2660-16-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/2660-13-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/2660-15-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/2660-20-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/2660-21-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/2660-22-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/2660-23-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/2660-25-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/2660-26-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/2660-27-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/2660-28-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/2660-29-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing