805635ff2391725a9889dd700f1bed7e7c5ddb9c388784cea58bf5698f87ee62

General

Target

63ef9777dddf71f23fd7c9693ee9d962c32ded177aa934c249750711edd6d284.exe
Size

1006KB
MD5

2a164382477a530bb4dda1c957bbba96
SHA1

e634767c70f4482d037350aa4724c05db1ee9dd5
SHA256

63ef9777dddf71f23fd7c9693ee9d962c32ded177aa934c249750711edd6d284
SHA512

7b9bc31b79920991ded02d8cf404549abb96b7fb92ca65b1be7b15b8479dd36530443cdc9c294b31fbb794687ca699b9350a7215d5daf56c4e80917796d7c288
SSDEEP

24576:vPOEPBSlwCToarjryVe1QTgcpu8RaL4U9ismhfz87brh8:5YlwCrrj2EQTzppa5ZYfz87h

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2212 set thread context of 2592	2212	63ef9777dddf71f23fd7c9693ee9d962c32ded177aa934c249750711edd6d284.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2780	2592	WerFault.exe	32

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2676	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2676	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2676	2212	63ef9777dddf71f23fd7c9693ee9d962c32ded177aa934c249750711edd6d284.exe	30
PID 2212 wrote to memory of 2676	2212	63ef9777dddf71f23fd7c9693ee9d962c32ded177aa934c249750711edd6d284.exe	30
PID 2212 wrote to memory of 2676	2212	63ef9777dddf71f23fd7c9693ee9d962c32ded177aa934c249750711edd6d284.exe	30
PID 2212 wrote to memory of 2676	2212	63ef9777dddf71f23fd7c9693ee9d962c32ded177aa934c249750711edd6d284.exe	30
PID 2212 wrote to memory of 2592	2212	63ef9777dddf71f23fd7c9693ee9d962c32ded177aa934c249750711edd6d284.exe	32
PID 2212 wrote to memory of 2592	2212	63ef9777dddf71f23fd7c9693ee9d962c32ded177aa934c249750711edd6d284.exe	32
PID 2212 wrote to memory of 2592	2212	63ef9777dddf71f23fd7c9693ee9d962c32ded177aa934c249750711edd6d284.exe	32
PID 2212 wrote to memory of 2592	2212	63ef9777dddf71f23fd7c9693ee9d962c32ded177aa934c249750711edd6d284.exe	32
PID 2212 wrote to memory of 2592	2212	63ef9777dddf71f23fd7c9693ee9d962c32ded177aa934c249750711edd6d284.exe	32
PID 2212 wrote to memory of 2592	2212	63ef9777dddf71f23fd7c9693ee9d962c32ded177aa934c249750711edd6d284.exe	32
PID 2212 wrote to memory of 2592	2212	63ef9777dddf71f23fd7c9693ee9d962c32ded177aa934c249750711edd6d284.exe	32
PID 2592 wrote to memory of 2780	2592	63ef9777dddf71f23fd7c9693ee9d962c32ded177aa934c249750711edd6d284.exe	33
PID 2592 wrote to memory of 2780	2592	63ef9777dddf71f23fd7c9693ee9d962c32ded177aa934c249750711edd6d284.exe	33
PID 2592 wrote to memory of 2780	2592	63ef9777dddf71f23fd7c9693ee9d962c32ded177aa934c249750711edd6d284.exe	33
PID 2592 wrote to memory of 2780	2592	63ef9777dddf71f23fd7c9693ee9d962c32ded177aa934c249750711edd6d284.exe	33

C:\Users\Admin\AppData\Local\Temp\63ef9777dddf71f23fd7c9693ee9d962c32ded177aa934c249750711edd6d284.exe
"C:\Users\Admin\AppData\Local\Temp\63ef9777dddf71f23fd7c9693ee9d962c32ded177aa934c249750711edd6d284.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\63ef9777dddf71f23fd7c9693ee9d962c32ded177aa934c249750711edd6d284.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2676
- C:\Users\Admin\AppData\Local\Temp\63ef9777dddf71f23fd7c9693ee9d962c32ded177aa934c249750711edd6d284.exe
  "C:\Users\Admin\AppData\Local\Temp\63ef9777dddf71f23fd7c9693ee9d962c32ded177aa934c249750711edd6d284.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 36
    3⤵
    - Program crash
    PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2212-14-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download
memory/2212-15-0x0000000074960000-0x000000007504E000-memory.dmp

Filesize
6.9MB

Download
memory/2212-2-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download
memory/2212-0-0x00000000001F0000-0x00000000002F2000-memory.dmp

Filesize
1.0MB

Download
memory/2212-4-0x0000000000590000-0x000000000059A000-memory.dmp

Filesize
40KB

Download
memory/2212-5-0x00000000005A0000-0x00000000005AE000-memory.dmp

Filesize
56KB

Download
memory/2212-6-0x0000000005070000-0x00000000050FC000-memory.dmp

Filesize
560KB

Download
memory/2212-7-0x0000000074960000-0x000000007504E000-memory.dmp

Filesize
6.9MB

Download
memory/2212-1-0x0000000074960000-0x000000007504E000-memory.dmp

Filesize
6.9MB

Download
memory/2212-3-0x00000000003F0000-0x0000000000404000-memory.dmp

Filesize
80KB

Download
memory/2592-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2592-13-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2592-10-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2592-8-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2676-18-0x0000000074960000-0x0000000074F0B000-memory.dmp

Filesize
5.7MB

Download
memory/2676-19-0x0000000074960000-0x0000000074F0B000-memory.dmp

Filesize
5.7MB

Download
memory/2676-20-0x0000000002620000-0x0000000002660000-memory.dmp

Filesize
256KB

Download
memory/2676-21-0x0000000002620000-0x0000000002660000-memory.dmp

Filesize
256KB

Download
memory/2676-22-0x0000000074960000-0x0000000074F0B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing