b6fe251f63967620aa825a84bec39adea438c1c8e29193f236ffc22bda75523b

General

Target
CC_AUTH.EXE
Size 428KB
Sample200624-2tz52ebnf2
SHA256 b6fe251f63967620aa825a84bec39adea438c1c8e29193f236ffc22bda75523b
MD5 b7fcf8c721a3540fbddc0184a7ef346f
SHA1 c884956febcc0c6cffb7c45bb47993fb665dea93
SHA512 efd06206b6dac000ce130547c15e02cbd0e07aa7d0af7b727818730e65d5f6625bf7178b5b3f2016b5b5200129f73c881d7014afe676fdcca4afb3b476a4722f
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2316	WerFault.exe
Token: SeBackupPrivilege	2316	WerFault.exe
Token: SeDebugPrivilege	2316	WerFault.exe
Token: SeDebugPrivilege	1772	WerFault.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
2316	WerFault.exe
2316	WerFault.exe
2316	WerFault.exe
2316	WerFault.exe
2316	WerFault.exe
2316	WerFault.exe
2316	WerFault.exe
2316	WerFault.exe
2316	WerFault.exe
2316	WerFault.exe
2316	WerFault.exe
2316	WerFault.exe
2316	WerFault.exe
1772	WerFault.exe
1772	WerFault.exe
1772	WerFault.exe
1772	WerFault.exe
1772	WerFault.exe
1772	WerFault.exe
1772	WerFault.exe
1772	WerFault.exe
1772	WerFault.exe
1772	WerFault.exe
1772	WerFault.exe
1772	WerFault.exe
1772	WerFault.exe
1772	WerFault.exe
1772	WerFault.exe

Adds Run entry to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe"	CC_AUTH.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 3680	3908	CC_AUTH.EXE	68
PID 3908 wrote to memory of 3680	3908	CC_AUTH.EXE	68
PID 3908 wrote to memory of 3680	3908	CC_AUTH.EXE	68
PID 3908 wrote to memory of 1752	3908	CC_AUTH.EXE	69
PID 3908 wrote to memory of 1752	3908	CC_AUTH.EXE	69
PID 3908 wrote to memory of 1752	3908	CC_AUTH.EXE	69
PID 1752 wrote to memory of 1184	1752	images.exe	76
PID 1752 wrote to memory of 1184	1752	images.exe	76
PID 1752 wrote to memory of 1184	1752	images.exe	76
PID 1752 wrote to memory of 1324	1752	images.exe	77
PID 1752 wrote to memory of 1324	1752	images.exe	77
PID 1752 wrote to memory of 1324	1752	images.exe	77
PID 1752 wrote to memory of 1324	1752	images.exe	77
PID 1752 wrote to memory of 1324	1752	images.exe	77

Executes dropped EXE 1 IoCs

pid	Process
1752	images.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2316	3680	WerFault.exe	68
1772	1184	WerFault.exe	76

C:\Users\Admin\AppData\Local\Temp\CC_AUTH.EXE
"C:\Users\Admin\AppData\Local\Temp\CC_AUTH.EXE"
1⤵
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell Add-MpPreference -ExclusionPath C:\
  2⤵
  PID:3680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 708
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    - Program crash
    PID:2316
- C:\ProgramData\images.exe
  "C:\ProgramData\images.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Executes dropped EXE
  PID:1752
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath C:\
    3⤵
    PID:1184
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1184 -s 704
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious behavior: EnumeratesProcesses
      Program crash
      PID:1772
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:1324

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1752-13-0x00000000022D0000-0x0000000002423000-memory.dmp

Download

memory/1772-22-0x0000000004E50000-0x0000000004E51000-memory.dmp

Download

memory/1772-16-0x0000000004720000-0x0000000004721000-memory.dmp

Download

memory/2316-12-0x0000000004F70000-0x0000000004F71000-memory.dmp

Download

memory/2316-5-0x0000000004840000-0x0000000004841000-memory.dmp

Download

memory/3908-0-0x0000000002260000-0x00000000023B3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads