4521b808bdef66ad187a6aed96eb2a853d60e758884b66aedf031cddf21a1fb4

General

Target

4521b808bdef66ad187a6aed96eb2a853d60e758884b66aedf031cddf21a1fb4
Sample

191025-747am3jafs
SHA256

4521b808bdef66ad187a6aed96eb2a853d60e758884b66aedf031cddf21a1fb4

Score

N/A

Malware Config

Signatures

Drops file in system dir 5 IoCs

description	ioc	pid	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	4156	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	4156	svchost.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	4156	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-2.tmp	4156	svchost.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-2.tmp	4156	svchost.exe

Checks system information in the registry (likely anti-VM) 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	pid	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	4340	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	4340	svchost.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

description	ioc	pid	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "0"	3680	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "1"	3680	svchost.exe

Drops Office document 19 IoCs

dropper exploiter maldoc

description	ioc	pid	Process
File opened for modification	\??\c:\Users\Admin\Desktop\WritePop.pptx	1736	4521b808bdef66ad187a6aed96eb2a853d60e758884b66aedf031cddf21a1fb4.exe
File opened for modification	\??\c:\Users\Admin\Desktop\SuspendAssert.xlsm	1736	4521b808bdef66ad187a6aed96eb2a853d60e758884b66aedf031cddf21a1fb4.exe
File opened for modification	\??\c:\Users\Admin\Documents\SubmitDebug.ppt	1736	4521b808bdef66ad187a6aed96eb2a853d60e758884b66aedf031cddf21a1fb4.exe
File opened for modification	\??\c:\Users\Admin\Documents\WriteDismount.xlsx	1736	4521b808bdef66ad187a6aed96eb2a853d60e758884b66aedf031cddf21a1fb4.exe
File opened for modification	\??\c:\Users\Admin\Downloads\TraceUninstall.xls	1736	4521b808bdef66ad187a6aed96eb2a853d60e758884b66aedf031cddf21a1fb4.exe
File opened for modification	\??\c:\Users\Admin\Downloads\TraceWatch.xlsb	1736	4521b808bdef66ad187a6aed96eb2a853d60e758884b66aedf031cddf21a1fb4.exe
File opened for modification	\??\c:\Users\Admin\Documents\ApproveMeasure.docm	1736	4521b808bdef66ad187a6aed96eb2a853d60e758884b66aedf031cddf21a1fb4.exe
File opened for modification	\??\c:\Users\Admin\Desktop\SkipUnlock.xltx	1736	4521b808bdef66ad187a6aed96eb2a853d60e758884b66aedf031cddf21a1fb4.exe
File opened for modification	\??\c:\Users\Admin\Documents\Are.docx	1736	4521b808bdef66ad187a6aed96eb2a853d60e758884b66aedf031cddf21a1fb4.exe
File opened for modification	\??\c:\Users\Admin\Desktop\OpenSplit.xltx	1736	4521b808bdef66ad187a6aed96eb2a853d60e758884b66aedf031cddf21a1fb4.exe
File opened for modification	\??\c:\Users\Admin\Documents\Files.docx	1736	4521b808bdef66ad187a6aed96eb2a853d60e758884b66aedf031cddf21a1fb4.exe
File opened for modification	\??\c:\Users\Admin\Documents\NewUnprotect.xltm	1736	4521b808bdef66ad187a6aed96eb2a853d60e758884b66aedf031cddf21a1fb4.exe
File opened for modification	\??\c:\Users\Admin\Documents\Opened.docx	1736	4521b808bdef66ad187a6aed96eb2a853d60e758884b66aedf031cddf21a1fb4.exe
File opened for modification	\??\c:\Users\Admin\Documents\OutConvert.docm	1736	4521b808bdef66ad187a6aed96eb2a853d60e758884b66aedf031cddf21a1fb4.exe
File opened for modification	\??\c:\Users\Admin\Documents\ReceiveEnable.pot	1736	4521b808bdef66ad187a6aed96eb2a853d60e758884b66aedf031cddf21a1fb4.exe
File opened for modification	\??\c:\Users\Admin\Documents\Recently.docx	1736	4521b808bdef66ad187a6aed96eb2a853d60e758884b66aedf031cddf21a1fb4.exe
File opened for modification	\??\c:\Users\Admin\Documents\These.docx	1736	4521b808bdef66ad187a6aed96eb2a853d60e758884b66aedf031cddf21a1fb4.exe
File opened for modification	\??\c:\Users\Admin\Downloads\SwitchLock.docx	1736	4521b808bdef66ad187a6aed96eb2a853d60e758884b66aedf031cddf21a1fb4.exe
File opened for modification	\??\c:\Users\Admin\Music\UninstallGet.docx	1736	4521b808bdef66ad187a6aed96eb2a853d60e758884b66aedf031cddf21a1fb4.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 5092	5064	SppExtComObj.exe	75
PID 4908 wrote to memory of 1736	4908	4521b808bdef66ad187a6aed96eb2a853d60e758884b66aedf031cddf21a1fb4.exe	77

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4908 set thread context of 1736	4908	4521b808bdef66ad187a6aed96eb2a853d60e758884b66aedf031cddf21a1fb4.exe	77

Modifies service 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

description	ioc	pid	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BITS\Performance\PerfMMFileName = "Global\\MMF_BITS96e7360e-981f-49f5-8ed6-e779ab77a38b"	4156	svchost.exe

C:\Users\Admin\AppData\Local\Temp\4521b808bdef66ad187a6aed96eb2a853d60e758884b66aedf031cddf21a1fb4.exe
"C:\Users\Admin\AppData\Local\Temp\4521b808bdef66ad187a6aed96eb2a853d60e758884b66aedf031cddf21a1fb4.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:4908

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:5064

C:\Windows\System32\SLUI.exe
"C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent
1⤵
PID:5092

C:\Users\Admin\AppData\Local\Temp\4521b808bdef66ad187a6aed96eb2a853d60e758884b66aedf031cddf21a1fb4.exe
"C:\Users\Admin\AppData\Local\Temp\4521b808bdef66ad187a6aed96eb2a853d60e758884b66aedf031cddf21a1fb4.exe"
1⤵
- Drops Office document
PID:1736

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Drops file in system dir
- Modifies service
PID:4156

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
1⤵
PID:3664

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s DoSvc
1⤵
- Checks system information in the registry (likely anti-VM)
PID:4340

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup
1⤵
PID:3700

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc
1⤵
- Windows security modification
PID:3680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Additional techniques

T1089
T1031

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1736-0-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1736-1-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

MITRE ATT&CK Additional techniques

Replay Monitor

Loading Replay Monitor...

Downloads