b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150

General

Target
b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150.exe
Size 491KB
Sample200624-aggbmsegg2
SHA256 b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150
MD5 108b7b7d44f6983ebb4079ae80dedb2e
SHA1 1d1d6748740b590bf0c4f381e1bbf2251ec368c9
SHA512 784e3f52aa9d915a412bd0c65e47d68335d713a4f4071eb48ffad0756e7ee66c42192229d516f0c340316c43705ebf7ff2dd75d5709331e6899216214bd75a81
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2148	images.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
3060	WerFault.exe
3060	WerFault.exe
3060	WerFault.exe
3060	WerFault.exe
3060	WerFault.exe
3060	WerFault.exe
3060	WerFault.exe
3060	WerFault.exe
3060	WerFault.exe
3060	WerFault.exe
3060	WerFault.exe
3060	WerFault.exe
3060	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2148	images.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat	b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start	b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150.exe

Adds Run entry to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe"	b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3748 wrote to memory of 1892	3748	b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150.exe	70
PID 3748 wrote to memory of 1892	3748	b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150.exe	70
PID 3748 wrote to memory of 1892	3748	b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150.exe	70
PID 3748 wrote to memory of 2148	3748	b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150.exe	72
PID 3748 wrote to memory of 2148	3748	b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150.exe	72
PID 3748 wrote to memory of 2148	3748	b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150.exe	72
PID 2148 wrote to memory of 3008	2148	images.exe	79
PID 2148 wrote to memory of 3008	2148	images.exe	79
PID 2148 wrote to memory of 3008	2148	images.exe	79
PID 2148 wrote to memory of 3844	2148	images.exe	81
PID 2148 wrote to memory of 3844	2148	images.exe	81
PID 2148 wrote to memory of 3844	2148	images.exe	81
PID 2148 wrote to memory of 3844	2148	images.exe	81
PID 2148 wrote to memory of 3844	2148	images.exe	81

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3060	1892	WerFault.exe	70
2272	3008	WerFault.exe	79

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	3060	WerFault.exe
Token: SeBackupPrivilege	3060	WerFault.exe
Token: SeDebugPrivilege	3060	WerFault.exe
Token: SeDebugPrivilege	2272	WerFault.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\ProgramData:ApplicationData	b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150.exe

C:\Users\Admin\AppData\Local\Temp\b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150.exe
"C:\Users\Admin\AppData\Local\Temp\b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150.exe"
1⤵
- Drops startup file
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
- NTFS ADS
PID:3748
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell Add-MpPreference -ExclusionPath C:\
  2⤵
  PID:1892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 704
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:3060
- C:\ProgramData\images.exe
  "C:\ProgramData\images.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath C:\
    3⤵
    PID:3008
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 704
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:2272
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:3844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2148-21-0x0000000000690000-0x00000000007E3000-memory.dmp

Download

memory/2272-30-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

Download

memory/2272-24-0x0000000004790000-0x0000000004791000-memory.dmp

Download

memory/3060-12-0x0000000005350000-0x0000000005351000-memory.dmp

Download

memory/3060-5-0x0000000004D20000-0x0000000004D21000-memory.dmp

Download

memory/3748-0-0x0000000000E70000-0x0000000000FC3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads