b61991e6b19229de40323d7e15e1b710a9e7f5fafe5d0ebdfc08918e373967d3

General

Target

b61991e6b19229de40323d7e15e1b710a9e7f5fafe5d0ebdfc08918e373967d3
Sample

191025-8ddaw5e4we
SHA256

b61991e6b19229de40323d7e15e1b710a9e7f5fafe5d0ebdfc08918e373967d3

Score

N/A

Malware Config

Signatures

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

description	ioc	pid	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "0"	4880	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "1"	4880	svchost.exe

Maps connected drives based on registry (likely anti-VM) 3 TTPs 2 IoCs

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	pid	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	4936	b61991e6b19229de40323d7e15e1b710a9e7f5fafe5d0ebdfc08918e373967d3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	4936	b61991e6b19229de40323d7e15e1b710a9e7f5fafe5d0ebdfc08918e373967d3.exe

Checks SCSI registry key(s) (likely anti-VM) 3 TTPs 2 IoCs

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	pid	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4936	b61991e6b19229de40323d7e15e1b710a9e7f5fafe5d0ebdfc08918e373967d3.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4936	b61991e6b19229de40323d7e15e1b710a9e7f5fafe5d0ebdfc08918e373967d3.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4936	b61991e6b19229de40323d7e15e1b710a9e7f5fafe5d0ebdfc08918e373967d3.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 5052	5024	SppExtComObj.exe	74

Modifies service 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

description	ioc	pid	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BITS\Performance\PerfMMFileName = "Global\\MMF_BITSe08eb620-abeb-4a61-8c08-003f1c495821"	4640	svchost.exe

Drops file in system dir 5 IoCs

description	ioc	pid	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	4640	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	4640	svchost.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	4640	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-2.tmp	4640	svchost.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-2.tmp	4640	svchost.exe

Checks system information in the registry (likely anti-VM) 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	pid	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	4316	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	4316	svchost.exe

C:\Users\Admin\AppData\Local\Temp\b61991e6b19229de40323d7e15e1b710a9e7f5fafe5d0ebdfc08918e373967d3.exe
"C:\Users\Admin\AppData\Local\Temp\b61991e6b19229de40323d7e15e1b710a9e7f5fafe5d0ebdfc08918e373967d3.exe"
1⤵
- Maps connected drives based on registry (likely anti-VM)
- Checks SCSI registry key(s) (likely anti-VM)
- Suspicious behavior: MapViewOfSection
PID:4936

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:5024

C:\Windows\System32\SLUI.exe
"C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent
1⤵
PID:5052

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Modifies service
- Drops file in system dir
PID:4640

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
1⤵
PID:1792

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s DoSvc
1⤵
- Checks system information in the registry (likely anti-VM)
PID:4316

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup
1⤵
PID:4184

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc
1⤵
- Windows security modification
PID:4880