5511834808385536.zip

General
Target

485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe

Filesize

106KB

Completed

06-04-2020 23:09

Score
8 /10
MD5

8c7ba09e5e8a46926f2e9233c2cbf3c5

SHA1

29b031dc4829b82bc35382ed3b00202653af6eee

SHA256

485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf

Malware Config
Signatures 9

Filter: none

Defense Evasion
Lateral Movement
Persistence
  • Modifies service
    netsh.exe

    TTPs

    Modify RegistryModify Existing Service

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shasnetsh.exe
    Key created\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecsnetsh.exe
    Key created\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UInetsh.exe
    Key created\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfignetsh.exe
    Key created\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroupsnetsh.exe
  • Drops autorun.inf file
    485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe

    TTPs

    Replication Through Removable Media

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\autorun.inf485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    File createdC:\autorun.inf485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
  • Suspicious use of WriteProcessMemory
    485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1832 wrote to memory of 18721832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exenetsh.exe
    PID 1832 wrote to memory of 18721832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exenetsh.exe
    PID 1832 wrote to memory of 18721832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exenetsh.exe
    PID 1832 wrote to memory of 18721832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exenetsh.exe
  • Suspicious use of AdjustPrivilegeToken
    485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 331832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 331832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 331832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 331832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 331832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 331832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 331832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 331832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 331832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 331832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 331832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 331832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 331832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 331832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 331832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 331832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: 331832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    Token: SeIncBasePriorityPrivilege1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
  • Suspicious behavior: EnumeratesProcesses
    485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe

    Reported IOCs

    pidprocess
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
  • Disables Task Manager via registry modification

    Tags

  • Suspicious behavior: GetForegroundWindowSpam
    485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe

    Reported IOCs

    pidprocess
    1832485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
  • Modifies Windows Firewall

    Tags

    TTPs

    Modify Existing Service
  • Drops startup file
    485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    File opened for modificationC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
Processes 2
  • C:\Users\Admin\AppData\Local\Temp\485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
    "C:\Users\Admin\AppData\Local\Temp\485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe"
    Drops autorun.inf file
    Suspicious use of WriteProcessMemory
    Suspicious use of AdjustPrivilegeToken
    Suspicious behavior: EnumeratesProcesses
    Suspicious behavior: GetForegroundWindowSpam
    Drops startup file
    PID:1832
    • C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe" "485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe" ENABLE
      Modifies service
      PID:1872
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Privilege Escalation
                    Replay Monitor
                    00:00 00:00
                    Downloads