9f14545a75612f60f8133b5f2d5444dd016a5a7043b54041e386e8d3eaad6079

General

Target

Exes_b93017f6a9ca17274861f865f069b975.exe
Sample

190903-ndr16jzc9n
SHA256

9f14545a75612f60f8133b5f2d5444dd016a5a7043b54041e386e8d3eaad6079

Score

N/A

Malware Config

Signatures

Suspicious use of SetWindowsHookEx

Modifies security service 2 TTPs 5 IoCs

Modify Registry

T1112

Processes:

Exes_b93017f6a9ca17274861f865f069b975.exe

at	description	ioc	process
1671	Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	Exes_b93017f6a9ca17274861f865f069b975.exe
1687	Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	Exes_b93017f6a9ca17274861f865f069b975.exe
1687	Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	Exes_b93017f6a9ca17274861f865f069b975.exe
1687	Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	Exes_b93017f6a9ca17274861f865f069b975.exe
1687	Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\Exes_b93017f6a9ca17274861f865f069b975.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Exes_b93017f6a9ca17274861f865f069b975.exe:*:Enabled:@xpsp2res.dll,-22008"	Exes_b93017f6a9ca17274861f865f069b975.exe

Modifies service 2 TTPs 3 IoCs

persistence

Modify Registry

T1112

Processes:

Exes_b93017f6a9ca17274861f865f069b975.exe

at	description	ioc	process
1671	Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess	Exes_b93017f6a9ca17274861f865f069b975.exe
1687	Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters	Exes_b93017f6a9ca17274861f865f069b975.exe
1687	Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy	Exes_b93017f6a9ca17274861f865f069b975.exe

C:\Users\Admin\AppData\Local\Temp\Exes_b93017f6a9ca17274861f865f069b975.exe
C:\Users\Admin\AppData\Local\Temp\Exes_b93017f6a9ca17274861f865f069b975.exe
1⤵
- Modifies security service
- Modifies service
PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Additional techniques

T1031

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

MITRE ATT&CK Additional techniques

Replay Monitor

Loading Replay Monitor...

Downloads