2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28

General

Target

2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Size

8.0MB
MD5

7212eb45b28ac2a4b5e2a47d2f092688
SHA1

552014abd99dabc1a31cff10f589811ea3ec95ef
SHA256

2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28
SHA512

08deb9b01909107ad7bd9a634207b8e3f5cd2d1713511f6d3cb4fcdf9dc6e66630ea686684c137a75caea57ccc4a013c7dfa9f4d196a2590013a85c0b0a16b4a
SSDEEP

196608:++HJ8d49OQoOGylEobGCbxdp2G0eGTa8vEWW6oVhL2X69DPt:++HUOGYbGCz0eGOQEV1S6

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
760	sg.tmp
4344	抽卡吗？兄弟V8.3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3772	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
3772	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeBackupPrivilege	3772	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: SeRestorePrivilege	3772	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: 33	3772	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: SeIncBasePriorityPrivilege	3772	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: 33	3772	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: SeIncBasePriorityPrivilege	3772	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: 33	3772	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: SeIncBasePriorityPrivilege	3772	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: SeBackupPrivilege	3076	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: SeRestorePrivilege	3076	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: 33	3076	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: SeIncBasePriorityPrivilege	3076	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: 33	3772	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: SeIncBasePriorityPrivilege	3772	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: SeRestorePrivilege	760	sg.tmp
Token: 35	760	sg.tmp
Token: SeSecurityPrivilege	760	sg.tmp
Token: SeSecurityPrivilege	760	sg.tmp
Token: 33	3772	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: SeIncBasePriorityPrivilege	3772	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: SeDebugPrivilege	3772	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: 33	3772	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: SeIncBasePriorityPrivilege	3772	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: SeBackupPrivilege	1988	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: SeRestorePrivilege	1988	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: 33	1988	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: SeIncBasePriorityPrivilege	1988	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 4644	3772	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	83
PID 3772 wrote to memory of 4644	3772	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	83
PID 3772 wrote to memory of 3076	3772	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	85
PID 3772 wrote to memory of 3076	3772	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	85
PID 3772 wrote to memory of 3076	3772	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	85
PID 3772 wrote to memory of 760	3772	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	86
PID 3772 wrote to memory of 760	3772	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	86
PID 3772 wrote to memory of 760	3772	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	86
PID 3772 wrote to memory of 4344	3772	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	91
PID 3772 wrote to memory of 4344	3772	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	91
PID 3772 wrote to memory of 4344	3772	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	91
PID 3772 wrote to memory of 1988	3772	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	100
PID 3772 wrote to memory of 1988	3772	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	100
PID 3772 wrote to memory of 1988	3772	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	100
PID 1988 wrote to memory of 1304	1988	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	101
PID 1988 wrote to memory of 1304	1988	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	101

C:\Users\Admin\AppData\Local\Temp\2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
"C:\Users\Admin\AppData\Local\Temp\2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c set
  2⤵
  PID:4644
- C:\Users\Admin\AppData\Local\Temp\2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
  PECMD**pecmd-cmd* PUTF -dd -skipb=1365504 -len=7012028 "C:\Users\Admin\AppData\Local\Temp\~5229094099207082600.tmp",,C:\Users\Admin\AppData\Local\Temp\2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3076
- C:\Users\Admin\AppData\Local\Temp\~6403656789041473954~\sg.tmp
  7zG_exe x "C:\Users\Admin\AppData\Local\Temp\~5229094099207082600.tmp" -y -aoa -o"C:\Users\Admin\AppData\Local\Temp\~6829845063675616693.."
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:760
- C:\Users\Admin\AppData\Local\Temp\~6829845063675616693..\抽卡吗？兄弟V8.3.exe
  "C:\Users\Admin\AppData\Local\Temp\~6829845063675616693..\抽卡吗？兄弟V8.3.exe"
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Users\Admin\AppData\Local\Temp\2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
  PECMD**pecmd-cmd* EXEC -wd:C: -hide cmd /c "C:\Users\Admin\AppData\Local\Temp\~6915044844571134065.cmd"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\~6915044844571134065.cmd"
    3⤵
    PID:1304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~5229094099207082600.tmp

Filesize
6.7MB

MD5
d47fdac1d234cb7d4a280e72ad6f70af

SHA1
b342c494715b4bcce0ec2af64b52090f6f4eb9e8

SHA256
66b72a2710e9d65c10d6917eea6a025ce3f0799037db3019e8472449a487e79b

SHA512
d3967590750ac81612783204da2d3c0d372a7236e0333243b12bee27c9c1d4b0e9e1b2c46dfaa2518f3fd98690184aaa2c0df03fc63fc4d5f5d19f10cc0145bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\~6403656789041473954~\sg.tmp

Filesize
715KB

MD5
7c4718943bd3f66ebdb47ccca72c7b1e

SHA1
f9edfaa7adb8fa528b2e61b2b251f18da10a6969

SHA256
4cc32d00338fc7b206a7c052297acf9ac304ae7de9d61a2475a116959c1524fc

SHA512
e18c40d646fa4948f90f7471da55489df431f255041ebb6dcef86346f91078c9b27894e27216a4b2fe2a1c5e501c7953c77893cf696930123d28a322d49e1516

Download Submit
C:\Users\Admin\AppData\Local\Temp\~6829845063675616693..\CET_Archive.dat

Filesize
6.3MB

MD5
03c60c52b8c8a92054dbb2e951a3224d

SHA1
25eeae4ca3c11d6e777eb44da1fd07f1033df589

SHA256
da682b60f58579862a8103a79dbf62615d6253af7090aae04779281fbe60277a

SHA512
539e0fc42a3498e15ec958ab6a95315236d4f69b4601809204af20f2ce91144e5b9c9ab0c1d7184b959caa8870ea53dccc8a72a421f955a652b14d79a9340cda

Download Submit
C:\Users\Admin\AppData\Local\Temp\~6829845063675616693..\抽卡吗？兄弟V8.3.exe

Filesize
478KB

MD5
122ab9d72198e982d73fe03ceec58ed5

SHA1
9d11e2c60f20be12c7a07a52ed45450a36d1eb05

SHA256
3483dd5330aa14a711b09a0bc7767ee3b127e6c4e2d981e938e76a31f09f8719

SHA512
904299cc4ab3736d36e09d694ae4e7b1185aacd119a478e91e407957c1ecb07a8d1191978edddc258f9de6857f6f0528d7840f502aae7f5a94072362593de2a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\~6915044844571134065.cmd

Filesize
379B

MD5
a4feb86005841272b7397900afe8de95

SHA1
40f2ce4cfc06693b177acb60f89f762d93fced94

SHA256
140f2fbeed495cee2b0e2445978d1200b34c0f056fe4cc1dfc6821fabb1f587c

SHA512
49471ce0bde39092c437869b3745e521e8240c977de97654ab32b9e142a63c092920e962fe05e1bdc3de78b7d20d25dc51bdced9a63fb3342636bd0fcaf1507c

Download Submit
C:\Users\Admin\AppData\Local\Temp\~~2584028824392269346.tmp

Filesize
120B

MD5
b87b12694b9ab3b62f50fecc52bb9c84

SHA1
8c59dc32239d531b5116cd5926e3dfe640321b1f

SHA256
d5c145580adb8bbec7d6d4426c3a7cc842f0024d173854992ec18b05408a0e84

SHA512
40f2b3bb9116e53a5b7507e864ccecaa1331dc02073e7dc13c8e470281a08b368d47b39946cc41f6e71314d723d54589fa8e3ac2457b9fd09fd7729127b1f992

Download Submit
memory/4344-25-0x00000000014C0000-0x0000000001530000-memory.dmp

Filesize
448KB

Download
memory/4344-26-0x00000000014C0000-0x0000000001530000-memory.dmp

Filesize
448KB

Download
memory/4344-29-0x00000000001B0000-0x00000000001BB000-memory.dmp

Filesize
44KB

Download
memory/4344-28-0x00000000001D0000-0x00000000001E2000-memory.dmp

Filesize
72KB

Download
memory/4344-27-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/4344-30-0x00000000014C0000-0x0000000001530000-memory.dmp

Filesize
448KB

Download
memory/4344-32-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/4344-24-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download

Analysis

Sharing