dddd9cd5cd6589c82939b6cb4d6b86c4f8f9be9b68d03a05bc1d00a048127d22

General

Target

dddd9cd5cd6589c82939b6cb4d6b86c4f8f9be9b68d03a05bc1d00a048127d22.exe
Size

689KB
MD5

dbd98458cb123671a003f169befd60d2
SHA1

26793d9703de699940311ef0e24db73500eed35c
SHA256

dddd9cd5cd6589c82939b6cb4d6b86c4f8f9be9b68d03a05bc1d00a048127d22
SHA512

c5317cf1730a547f67a06731048c232cf84d48dff1d0ac7f01c19a950f19c8156362de6fdb9db09315a7570339745611fc9fa8112a1876e7df23a5072fb8efa6
SSDEEP

12288:pxOh68zQOFvwyzwx4C6XF5yH2OCgA++NGV3RyEXnwxNzEUN2jFlPuoAyJ:pC68QGe4lFG2OCgApmhXwxNzEUN2jrPv

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3012	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1028 set thread context of 2692	1028	dddd9cd5cd6589c82939b6cb4d6b86c4f8f9be9b68d03a05bc1d00a048127d22.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2832	2692	WerFault.exe	33

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3012	powershell.exe
2692	dddd9cd5cd6589c82939b6cb4d6b86c4f8f9be9b68d03a05bc1d00a048127d22.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3012	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 3012	1028	dddd9cd5cd6589c82939b6cb4d6b86c4f8f9be9b68d03a05bc1d00a048127d22.exe	31
PID 1028 wrote to memory of 3012	1028	dddd9cd5cd6589c82939b6cb4d6b86c4f8f9be9b68d03a05bc1d00a048127d22.exe	31
PID 1028 wrote to memory of 3012	1028	dddd9cd5cd6589c82939b6cb4d6b86c4f8f9be9b68d03a05bc1d00a048127d22.exe	31
PID 1028 wrote to memory of 3012	1028	dddd9cd5cd6589c82939b6cb4d6b86c4f8f9be9b68d03a05bc1d00a048127d22.exe	31
PID 1028 wrote to memory of 2692	1028	dddd9cd5cd6589c82939b6cb4d6b86c4f8f9be9b68d03a05bc1d00a048127d22.exe	33
PID 1028 wrote to memory of 2692	1028	dddd9cd5cd6589c82939b6cb4d6b86c4f8f9be9b68d03a05bc1d00a048127d22.exe	33
PID 1028 wrote to memory of 2692	1028	dddd9cd5cd6589c82939b6cb4d6b86c4f8f9be9b68d03a05bc1d00a048127d22.exe	33
PID 1028 wrote to memory of 2692	1028	dddd9cd5cd6589c82939b6cb4d6b86c4f8f9be9b68d03a05bc1d00a048127d22.exe	33
PID 1028 wrote to memory of 2692	1028	dddd9cd5cd6589c82939b6cb4d6b86c4f8f9be9b68d03a05bc1d00a048127d22.exe	33
PID 1028 wrote to memory of 2692	1028	dddd9cd5cd6589c82939b6cb4d6b86c4f8f9be9b68d03a05bc1d00a048127d22.exe	33
PID 1028 wrote to memory of 2692	1028	dddd9cd5cd6589c82939b6cb4d6b86c4f8f9be9b68d03a05bc1d00a048127d22.exe	33
PID 2692 wrote to memory of 2832	2692	dddd9cd5cd6589c82939b6cb4d6b86c4f8f9be9b68d03a05bc1d00a048127d22.exe	34
PID 2692 wrote to memory of 2832	2692	dddd9cd5cd6589c82939b6cb4d6b86c4f8f9be9b68d03a05bc1d00a048127d22.exe	34
PID 2692 wrote to memory of 2832	2692	dddd9cd5cd6589c82939b6cb4d6b86c4f8f9be9b68d03a05bc1d00a048127d22.exe	34
PID 2692 wrote to memory of 2832	2692	dddd9cd5cd6589c82939b6cb4d6b86c4f8f9be9b68d03a05bc1d00a048127d22.exe	34

C:\Users\Admin\AppData\Local\Temp\dddd9cd5cd6589c82939b6cb4d6b86c4f8f9be9b68d03a05bc1d00a048127d22.exe
"C:\Users\Admin\AppData\Local\Temp\dddd9cd5cd6589c82939b6cb4d6b86c4f8f9be9b68d03a05bc1d00a048127d22.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\dddd9cd5cd6589c82939b6cb4d6b86c4f8f9be9b68d03a05bc1d00a048127d22.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3012
- C:\Users\Admin\AppData\Local\Temp\dddd9cd5cd6589c82939b6cb4d6b86c4f8f9be9b68d03a05bc1d00a048127d22.exe
  "C:\Users\Admin\AppData\Local\Temp\dddd9cd5cd6589c82939b6cb4d6b86c4f8f9be9b68d03a05bc1d00a048127d22.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 36
    3⤵
    - Program crash
    PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1028-0-0x000000007458E000-0x000000007458F000-memory.dmp

Filesize
4KB

Download
memory/1028-1-0x0000000000E30000-0x0000000000EE2000-memory.dmp

Filesize
712KB

Download
memory/1028-2-0x0000000074580000-0x0000000074C6E000-memory.dmp

Filesize
6.9MB

Download
memory/1028-3-0x0000000000270000-0x0000000000280000-memory.dmp

Filesize
64KB

Download
memory/1028-4-0x00000000002F0000-0x00000000002FE000-memory.dmp

Filesize
56KB

Download
memory/1028-5-0x0000000004E20000-0x0000000004EAE000-memory.dmp

Filesize
568KB

Download
memory/1028-12-0x0000000074580000-0x0000000074C6E000-memory.dmp

Filesize
6.9MB

Download
memory/2692-7-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2692-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2692-6-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2692-11-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2692-15-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download

Analysis

Sharing