c10f26bbcca25dd6172ca3b0ec09a8d67f37d0879e2947c13e06e840fdc9395b

General

Target

c10f26bbcca25dd6172ca3b0ec09a8d67f37d0879e2947c13e06e840fdc9395b
Sample

191025-exgsf1vn1x
SHA256

c10f26bbcca25dd6172ca3b0ec09a8d67f37d0879e2947c13e06e840fdc9395b

Score

N/A

Malware Config

Signatures

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4960	c10f26bbcca25dd6172ca3b0ec09a8d67f37d0879e2947c13e06e840fdc9395b.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2740	c10f26bbcca25dd6172ca3b0ec09a8d67f37d0879e2947c13e06e840fdc9395b.exe

Drops file in system dir 5 IoCs

description	ioc	pid	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	1492	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	1492	svchost.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	1492	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-2.tmp	1492	svchost.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-2.tmp	1492	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 5104	5076	SppExtComObj.exe	74
PID 4960 wrote to memory of 2840	4960	c10f26bbcca25dd6172ca3b0ec09a8d67f37d0879e2947c13e06e840fdc9395b.exe	76
PID 4960 wrote to memory of 2740	4960	c10f26bbcca25dd6172ca3b0ec09a8d67f37d0879e2947c13e06e840fdc9395b.exe	77

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4960	c10f26bbcca25dd6172ca3b0ec09a8d67f37d0879e2947c13e06e840fdc9395b.exe

Modifies service 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

description	ioc	pid	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BITS\Performance\PerfMMFileName = "Global\\MMF_BITS70a7c604-90e5-45a2-8789-3728e163b885"	1492	svchost.exe

Checks system information in the registry (likely anti-VM) 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	pid	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	3740	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	3740	svchost.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

description	ioc	pid	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "0"	4252	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "1"	4252	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4960 set thread context of 2740	4960	c10f26bbcca25dd6172ca3b0ec09a8d67f37d0879e2947c13e06e840fdc9395b.exe	77

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2740	c10f26bbcca25dd6172ca3b0ec09a8d67f37d0879e2947c13e06e840fdc9395b.exe

C:\Users\Admin\AppData\Local\Temp\c10f26bbcca25dd6172ca3b0ec09a8d67f37d0879e2947c13e06e840fdc9395b.exe
"C:\Users\Admin\AppData\Local\Temp\c10f26bbcca25dd6172ca3b0ec09a8d67f37d0879e2947c13e06e840fdc9395b.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:4960

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:5076

C:\Windows\System32\SLUI.exe
"C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent
1⤵
PID:5104

C:\Users\Admin\AppData\Local\Temp\c10f26bbcca25dd6172ca3b0ec09a8d67f37d0879e2947c13e06e840fdc9395b.exe
"C:\Users\Admin\AppData\Local\Temp\c10f26bbcca25dd6172ca3b0ec09a8d67f37d0879e2947c13e06e840fdc9395b.exe"
1⤵
PID:2840

C:\Users\Admin\AppData\Local\Temp\c10f26bbcca25dd6172ca3b0ec09a8d67f37d0879e2947c13e06e840fdc9395b.exe
"C:\Users\Admin\AppData\Local\Temp\c10f26bbcca25dd6172ca3b0ec09a8d67f37d0879e2947c13e06e840fdc9395b.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:2740

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Drops file in system dir
- Modifies service
PID:1492

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
1⤵
PID:4504

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s DoSvc
1⤵
- Checks system information in the registry (likely anti-VM)
PID:3740

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup
1⤵
PID:4136

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc
1⤵
- Windows security modification
PID:4252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Additional techniques

T1031
T1089

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

MITRE ATT&CK Additional techniques

Replay Monitor

Loading Replay Monitor...

Downloads