b61991e6b19229de40323d7e15e1b710a9e7f5fafe5d0ebdfc08918e373967d3

General

Target

b61991e6b19229de40323d7e15e1b710a9e7f5fafe5d0ebdfc08918e373967d3
Sample

191025-kxzs4lzvyj
SHA256

b61991e6b19229de40323d7e15e1b710a9e7f5fafe5d0ebdfc08918e373967d3

Score

N/A

Malware Config

Signatures

Maps connected drives based on registry (likely anti-VM) 3 TTPs 2 IoCs

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	pid	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	5104	b61991e6b19229de40323d7e15e1b710a9e7f5fafe5d0ebdfc08918e373967d3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	5104	b61991e6b19229de40323d7e15e1b710a9e7f5fafe5d0ebdfc08918e373967d3.exe

Checks SCSI registry key(s) (likely anti-VM) 3 TTPs 2 IoCs

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	pid	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5104	b61991e6b19229de40323d7e15e1b710a9e7f5fafe5d0ebdfc08918e373967d3.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5104	b61991e6b19229de40323d7e15e1b710a9e7f5fafe5d0ebdfc08918e373967d3.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
5104	b61991e6b19229de40323d7e15e1b710a9e7f5fafe5d0ebdfc08918e373967d3.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2100	2036	SppExtComObj.exe	74

Modifies service 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

description	ioc	pid	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BITS\Performance\PerfMMFileName = "Global\\MMF_BITS716bcb1e-1196-41f0-a3f9-f3bef26918c6"	4832	svchost.exe

Drops file in system dir 5 IoCs

description	ioc	pid	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	4832	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	4832	svchost.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	4832	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-2.tmp	4832	svchost.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-2.tmp	4832	svchost.exe

Checks system information in the registry (likely anti-VM) 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	pid	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	4384	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	4384	svchost.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

description	ioc	pid	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "0"	5064	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "1"	5064	svchost.exe

C:\Users\Admin\AppData\Local\Temp\b61991e6b19229de40323d7e15e1b710a9e7f5fafe5d0ebdfc08918e373967d3.exe
"C:\Users\Admin\AppData\Local\Temp\b61991e6b19229de40323d7e15e1b710a9e7f5fafe5d0ebdfc08918e373967d3.exe"
1⤵
- Maps connected drives based on registry (likely anti-VM)
- Checks SCSI registry key(s) (likely anti-VM)
- Suspicious behavior: MapViewOfSection
PID:5104

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\System32\SLUI.exe
"C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent
1⤵
PID:2100

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Modifies service
- Drops file in system dir
PID:4832

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
1⤵
PID:4008

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s DoSvc
1⤵
- Checks system information in the registry (likely anti-VM)
PID:4384

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc
1⤵
- Windows security modification
PID:5064