118d8fd564546c1053e30dbebd4ab7c903831865bc97e767ff6378a45d4dcf92

General

Target

118d8fd564546c1053e30dbebd4ab7c903831865bc97e767ff6378a45d4dcf92.exe
Size

734KB
MD5

22839b4a8ea2f64e0257e2ee0042df3c
SHA1

e53d6f6f01f930ca2ee612f1b5a06b94fee9f1f2
SHA256

118d8fd564546c1053e30dbebd4ab7c903831865bc97e767ff6378a45d4dcf92
SHA512

495e35ae6b29d327989b305a523a0d5f546c9b8973e6b4502b1ceacb925475edc7b6b6a3eff2d8841b206400cc2d7c0a4ac1bdf4459f57c3c60cb17a12d029ab
SSDEEP

12288:iWiuaKWgPgrNHBMWrGARAoI0dGYoBInL18VqRvj4Jn8JOneJ0RHh2CVPdlIMXkR:iFngopBrHmoT2InB8YRv0esnwG2CjG

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2316	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2308 set thread context of 1864	2308	118d8fd564546c1053e30dbebd4ab7c903831865bc97e767ff6378a45d4dcf92.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2584	1864	WerFault.exe	33

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2316	powershell.exe
1864	118d8fd564546c1053e30dbebd4ab7c903831865bc97e767ff6378a45d4dcf92.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2316	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2316	2308	118d8fd564546c1053e30dbebd4ab7c903831865bc97e767ff6378a45d4dcf92.exe	31
PID 2308 wrote to memory of 2316	2308	118d8fd564546c1053e30dbebd4ab7c903831865bc97e767ff6378a45d4dcf92.exe	31
PID 2308 wrote to memory of 2316	2308	118d8fd564546c1053e30dbebd4ab7c903831865bc97e767ff6378a45d4dcf92.exe	31
PID 2308 wrote to memory of 2316	2308	118d8fd564546c1053e30dbebd4ab7c903831865bc97e767ff6378a45d4dcf92.exe	31
PID 2308 wrote to memory of 1864	2308	118d8fd564546c1053e30dbebd4ab7c903831865bc97e767ff6378a45d4dcf92.exe	33
PID 2308 wrote to memory of 1864	2308	118d8fd564546c1053e30dbebd4ab7c903831865bc97e767ff6378a45d4dcf92.exe	33
PID 2308 wrote to memory of 1864	2308	118d8fd564546c1053e30dbebd4ab7c903831865bc97e767ff6378a45d4dcf92.exe	33
PID 2308 wrote to memory of 1864	2308	118d8fd564546c1053e30dbebd4ab7c903831865bc97e767ff6378a45d4dcf92.exe	33
PID 2308 wrote to memory of 1864	2308	118d8fd564546c1053e30dbebd4ab7c903831865bc97e767ff6378a45d4dcf92.exe	33
PID 2308 wrote to memory of 1864	2308	118d8fd564546c1053e30dbebd4ab7c903831865bc97e767ff6378a45d4dcf92.exe	33
PID 2308 wrote to memory of 1864	2308	118d8fd564546c1053e30dbebd4ab7c903831865bc97e767ff6378a45d4dcf92.exe	33
PID 1864 wrote to memory of 2584	1864	118d8fd564546c1053e30dbebd4ab7c903831865bc97e767ff6378a45d4dcf92.exe	34
PID 1864 wrote to memory of 2584	1864	118d8fd564546c1053e30dbebd4ab7c903831865bc97e767ff6378a45d4dcf92.exe	34
PID 1864 wrote to memory of 2584	1864	118d8fd564546c1053e30dbebd4ab7c903831865bc97e767ff6378a45d4dcf92.exe	34
PID 1864 wrote to memory of 2584	1864	118d8fd564546c1053e30dbebd4ab7c903831865bc97e767ff6378a45d4dcf92.exe	34

C:\Users\Admin\AppData\Local\Temp\118d8fd564546c1053e30dbebd4ab7c903831865bc97e767ff6378a45d4dcf92.exe
"C:\Users\Admin\AppData\Local\Temp\118d8fd564546c1053e30dbebd4ab7c903831865bc97e767ff6378a45d4dcf92.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\118d8fd564546c1053e30dbebd4ab7c903831865bc97e767ff6378a45d4dcf92.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2316
- C:\Users\Admin\AppData\Local\Temp\118d8fd564546c1053e30dbebd4ab7c903831865bc97e767ff6378a45d4dcf92.exe
  "C:\Users\Admin\AppData\Local\Temp\118d8fd564546c1053e30dbebd4ab7c903831865bc97e767ff6378a45d4dcf92.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 36
    3⤵
    - Program crash
    PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1864-7-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1864-10-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1864-11-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1864-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1864-6-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1864-15-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2308-1-0x00000000009A0000-0x0000000000A5A000-memory.dmp

Filesize
744KB

Download
memory/2308-3-0x0000000074BC0000-0x00000000752AE000-memory.dmp

Filesize
6.9MB

Download
memory/2308-2-0x0000000000780000-0x000000000079A000-memory.dmp

Filesize
104KB

Download
memory/2308-4-0x00000000008A0000-0x00000000008AE000-memory.dmp

Filesize
56KB

Download
memory/2308-5-0x00000000042D0000-0x000000000435E000-memory.dmp

Filesize
568KB

Download
memory/2308-0-0x0000000074BCE000-0x0000000074BCF000-memory.dmp

Filesize
4KB

Download
memory/2308-12-0x0000000074BC0000-0x00000000752AE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing